CVE-2013-1088

2013-04-2400:00:00

ubuntu.com

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

34.7%

JSON

Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7
before SP6 Patch 1 allows remote attackers to hijack the authentication of
arbitrary users by leveraging improper request validation by iManager code
deployed within an Apache Tomcat container.

Notes

Author	Note
jdstrand	not clear from Novell advisory if this is tomcat itself or their use of tomcat. Novell bug is private. As of 2013-04-24, no upstream commits to trunk for this issue
mdeslaur	No indication that this is an issue in tomcat. Marking as not-affected.