Lucene search

PRIOn knowledge basePRION:CVE-2009-4898

HistorySep 07, 2010 - 5:00 p.m.

Cross site request forgery (csrf)

2010-09-0717:00:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.2%

JSON

Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.2 allows remote attackers to hijack the authentication of arbitrary users for requests that update pages, as demonstrated by a URL for a save script in the ACTION attribute of a FORM element, in conjunction with a call to the submit method in the onload attribute of a BODY element. NOTE: this issue exists because of an insufficient fix for CVE-2009-1339.

CPENameOperatorVersion
twikieq4.1.1
twikieq4.0.1
twikieq4.2.3
twikieq4.2.4
twikieq4.3.0
twikile4.3.1
twikieq4.0.3
twikieq4.0.4
twikieq4.2.1
twikieq4.2.0

Name	Operator	Version
twiki	eq	4.1.1
twiki	eq	4.0.1
twiki	eq	4.2.3
twiki	eq	4.2.4
twiki	eq	4.3.0
twiki	le	4.3.1
twiki	eq	4.0.3
twiki	eq	4.0.4
twiki	eq	4.2.1
twiki	eq	4.2.0

Rows per page:

1-10 of 161

References

twiki.org/cgi-bin/view/Codev/SecurityAuditTokenBasedCsrfFix

www.openwall.com/lists/oss-security/2010/08/02/17

www.openwall.com/lists/oss-security/2010/08/03/8

7.2 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.2%

JSON

Related for PRION:CVE-2009-4898