Lucene search

MitreCVE-2009-4385

HistoryDec 22, 2009 - 11:30 p.m.

CVE-2009-4385

2009-12-2223:30:00

CWE-352

mitre

web.nvd.nist.gov

cve-2009-4385

cross-site request forgery

csrf

scriptsez.net ez poll hoster

eph

authentication hijacking

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.4

Confidence

Low

EPSS

0.003

Percentile

70.2%

JSON

Multiple cross-site request forgery (CSRF) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to (1) hijack the authentication of arbitrary users for requests that delete polls via the delete_poll action to index.php; and hijack the authentication of administrators for requests that (2) delete users via the manage action to admin.php, or (3) send arbitrary email to arbitrary users in the email action to admin.php.

Affected configurations

Nvd

Node

scriptsezez_poll_hoster

VendorProductVersionCPE
scriptsezez_poll_hoster*cpe:2.3:a:scriptsez:ez_poll_hoster:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
scriptsez	ez_poll_hoster	*	cpe:2.3:a:scriptsez:ez_poll_hoster::::::::

References

packetstormsecurity.org/0912-exploits/ezpollhoster-xssxsrf.txt

secunia.com/advisories/37716

www.exploit-db.com/exploits/10439

www.vupen.com/english/advisories/2009/3529

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.4

Confidence

Low

EPSS

0.003

Percentile

70.2%

JSON

Related for CVE-2009-4385