Cross site request forgery (csrf)

2011-07-2920:55:00

PRIOn knowledge base

www.prio-n.com

7.6 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.008 Low

EPSS

Percentile

81.1%

JSON

Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program.

CPENameOperatorVersion
ubuntu_linuxeq10.10
ubuntu_linuxeq11.04
ubuntu_linuxeq8.04
ubuntu_linuxeq10.04
debian_linuxeq5.0
debian_linuxeq7.0
debian_linuxeq6.0
sambage3.0.0
sambalt3.3.16
sambage3.4.0

Name	Operator	Version
ubuntu_linux	eq	10.10
ubuntu_linux	eq	11.04
ubuntu_linux	eq	8.04
ubuntu_linux	eq	10.04
debian_linux	eq	5.0
debian_linux	eq	7.0
debian_linux	eq	6.0
samba	ge	3.0.0
samba	lt	3.3.16
samba	ge	3.4.0