CVE-2014-2989: Cross-site request forgery (CSRF) vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote att...

Security readout for executives and security teams

This CVE describes a CSRF flaw in Open Assessment Technologies TAO 2.5.6. If an authenticated administrator is tricked into making a forged request, an attacker could cause creation of an administrative account. Business risk is strongest where TAO admin access is reachable and administrators use active browser sessions. Exposure is likely limited to organizations running Open Assessment Technologies TAO 2.5.6, especially internet-reachable or broadly accessible administrative portals. The supplied affected-product metadata is incomplete, so version inventory is essential. Prioritize remediation if TAO 2.5.6 is still used for assessments or identity administration. The issue can create unauthorized administrators, but source evidence is incomplete and does not show active exploitation. Mitigation focus: Check TAO vendor guidance for fixed versions or official workarounds.; Upgrade or retire TAO 2.5.6 if vendor guidance identifies a supported replacement.; Restrict TAO administrative access to trusted networks or VPN users..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.