CVE-2017-8930
Last modified
CVE-2017-8930 is a vulnerability of currently unknown severity. Multiple cross-site request forgery (CSRF) vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can (1) create new administrator user accounts and take over the entire application, (2) create regular user accounts, or (3) change configuration parameters such as tax rates and the enable/disable status of PayPal payment modules.. EPSS estimates a 0.72% chance of exploitation in the next 30 days.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can (1) create new administrator user accounts and take over the entire application, (2) create regular user accounts, or (3) change configuration parameters such as tax rates and the enable/disable status of PayPal payment modules.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Simpleinvoices | Simple Invoices | 2013.1 | Beta8 |
References
- https://github.com/simpleinvoices/simpleinvoices/issues/270Third Party Advisory
- https://github.com/simpleinvoices/simpleinvoices/issues/270Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-8930?
How severe is CVE-2017-8930?
How do I fix CVE-2017-8930?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-8924The edge_bulk_in_callback function in drivers/usb/serial/io_…
- CVE-2017-8925The omninet_open function in drivers/usb/serial/omninet.c in…
- CVE-2017-8926Buffer overflow in Halliburton LogView Pro 10.0.1 allows att…
- CVE-2017-8927Buffer overflow in Larson VizEx Reader 9.7.5 allows attacker…7.8
- CVE-2017-8928mailcow 0.14, as used in "mailcow: dockerized" and other pro…8.8
- CVE-2017-8929The sized_string_cmp function in libyara/sizedstr.c in YARA …
- CVE-2017-8931Bitdefender GravityZone VMware appliance before 6.2.1-35 mig…
- CVE-2017-8932A bug in the standard library ScalarMult implementation of c…
- CVE-2017-8933Libmenu-cache 1.0.2 insecurely uses /tmp for a socket file, …
- CVE-2017-8934PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowi…
- CVE-2017-8935The Quest Information Systems Indiana Voters app 1.1.24 for …5.9
- CVE-2017-8936The MoboTap Dolphin Web Browser - Fast Private Internet Sear…5.9
Are you affected by CVE-2017-8930?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST