Search...

CollabNet Subversion Edge missing XSRF protection

2015-07-05T00:00:00

ID SECURITYVULNS:DOC:32281
Type securityvulns
Reporter Securityvulns
Modified 2015-07-05T00:00:00

Description

Vuln Title: The CollabNet Subversion Edge Management Frontend does not implement XSRF protection tokens

Date: 28.06.2015

Author: otr

Software Link: https://www.open.collab.net/downloads/svnedge

Vendor: CollabNet

Version: 4.0.11

Tested on: Fedora Linux

Type: XSRF

Risk: Low

Status: public/fixed

Fixed version: 5.0

Timeline:

2014-10-09 Flaw Discovered 2014-10-20 Vendor contacted 2014-10-21 Vendor response 2014-12-08 Vendor fix proposal 2014-12-08 Extension of embargo to 19.4.2015 2015-05-04 Extension of embargo until release of version 5.0 2015-05-18 Release of version 5.0 and public disclosure

Summary:

The CollabNet Subversion Edge Management Frontend does not implement XSRF protection tokens.

Fix proposal:

Implement XSRF protection.

Vendor fix:

Fixed.

JSON Vulners Source

Initial Source

{"id": "SECURITYVULNS:DOC:32281", "bulletinFamily": "software", "title": "CollabNet Subversion Edge missing XSRF protection", "description": "\r\n\r\n# Vuln Title: The CollabNet Subversion Edge Management Frontend does not implement XSRF protection tokens\r\n#\r\n# Date: 28.06.2015\r\n# Author: otr\r\n# Software Link: https://www.open.collab.net/downloads/svnedge\r\n# Vendor: CollabNet\r\n# Version: 4.0.11\r\n# Tested on: Fedora Linux\r\n# Type: XSRF\r\n#\r\n# Risk: Low\r\n# Status: public/fixed\r\n# Fixed version: 5.0\r\n\r\nTimeline:\r\n\r\n2014-10-09 Flaw Discovered\r\n2014-10-20 Vendor contacted\r\n2014-10-21 Vendor response\r\n2014-12-08 Vendor fix proposal\r\n2014-12-08 Extension of embargo to 19.4.2015\r\n2015-05-04 Extension of embargo until release of version 5.0\r\n2015-05-18 Release of version 5.0 and public disclosure\r\n\r\nSummary:\r\n\r\nThe CollabNet Subversion Edge Management Frontend does not implement XSRF\r\nprotection tokens.\r\n\r\nFix proposal:\r\n\r\nImplement XSRF protection.\r\n\r\nVendor fix:\r\n\r\nFixed.\r\n\r\n", "published": "2015-07-05T00:00:00", "modified": "2015-07-05T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32281", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:11:00", "edition": 1, "viewCount": 11, "enchantments": {"score": {"value": 2.6, "vector": "NONE"}, "dependencies": {"references": []}, "backreferences": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:14567"]}]}, "exploitation": null, "vulnersScore": 2.6}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1647589307, "score": 0}}