TorrentFlux 2.4 allows remote authenticated users to delete or modify other users’ cookies via the cid parameter in an editCookies action to profile.php.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6029
Reference (s):
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759573
- MLIST:[oss-security] 20140829 RE: CVE requests for 2 separate vulns in torrentflux 2.4.5-1 (debian stable)
- URL: http://www.openwall.com/lists/oss-security/2014/08/29/5
- MLIST:[oss-security] 20140902 Re: CVE requests for 2 separate vulns in torrentflux 2.4.5-1 (debian stable)
- URL: http://www.openwall.com/lists/oss-security/2014/09/02/3