Cross site request forgery (csrf)

2010-12-0620:13:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

82.6%

JSON

Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1; and Apache Continuum 1.3.6, 1.4.0, and 1.1 through 1.2.3.1; allows remote attackers to hijack the authentication of administrators for requests that modify credentials.

CPENameOperatorVersion
archivaeq1.0
archivaeq1.0.1
archivaeq1.0.2
archivaeq1.0.3
archivaeq1.1
archivaeq1.1.1
archivaeq1.1.2
archivaeq1.1.3
archivaeq1.1.4
archivaeq1.2

Name	Operator	Version
archiva	eq	1.0
archiva	eq	1.0.1
archiva	eq	1.0.2
archiva	eq	1.0.3
archiva	eq	1.1
archiva	eq	1.1.1
archiva	eq	1.1.2
archiva	eq	1.1.3
archiva	eq	1.1.4
archiva	eq	1.2

Rows per page:

1-10 of 281

References

archiva.apache.org/security.html

continuum.apache.org/security.html

jira.codehaus.org/browse/MRM-1438

mail-archives.apache.org/mod_mbox/archiva-users/201011.mbox/ajax/%3CAANLkTimXejHAuXdoUKLN=GkNty1_XnRCbv0YA0T2cS_2%40mail.gmail.com%3E

mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C032C189E-D821-4833-A8F2-F72365147695%40apache.org%3E

seclists.org/fulldisclosure/2011/Feb/238

secunia.com/advisories/42376

secunia.com/advisories/43261

svn.apache.org/viewvc/archiva/branches/archiva-1.3.x/archiva-modules/archiva-web/archiva-webapp/src/main/resources/struts.xml?r1=1038518&r2=1038517&pathrev=1038518

svn.apache.org/viewvc/archiva/branches/archiva-1.3.x/pom.xml?r1=1038518&r2=1038517&pathrev=1038518

svn.apache.org/viewvc?view=revision&revision=1038518

svn.apache.org/viewvc?view=revision&revision=1066010

www.osvdb.org/69520

www.securityfocus.com/archive/1/514937/100/0/threaded

www.securityfocus.com/archive/1/516341/100/0/threaded

www.securityfocus.com/bid/45095

www.securitytracker.com/id?1025066

www.vupen.com/english/advisories/2010/3098

www.vupen.com/english/advisories/2011/0373