CVE-2009-1434 - Cross-site request forgery (CSRF) vulnerability in Foswiki before 1.0.5 allows remote attackers to hijack the authentication of arbitrary users for requests that modify pages, change permissions, or change group memberships, as demonstrated by a URL for a (1) save or (2) view script in the SRC attribute of an IMG element, a related issue to CVE-2009-1339

Back Back to CVE browser

MEDIUM

Cross-site request forgery (CSRF) vulnerability in Foswiki before 1.0.5 allows remote attackers to hijack the authentication of arbitrary users for requests that modify pages, change permissions, or change group memberships, as demonstrated by a URL for a (1) save or (2) view script in the SRC attribute of an IMG element, a related issue to CVE-2009-1339

Published Apr 30, 2009

6.8

MEDIUM

CVSS 2.0

EPSS 0.67%

Description

Cross-site request forgery (CSRF) vulnerability in Foswiki before 1.0.5 allows remote attackers to hijack the authentication of arbitrary users for requests that modify pages, change permissions, or change group memberships, as demonstrated by a URL for a (1) save or (2) view script in the SRC attribute of an IMG element, a related issue to CVE-2009-1339.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (7)

http://foswiki.org/Support/SecurityAlert-CVE-2009-1434
x_refsource_CONFIRMPatchVendor Advisory
http://osvdb.org/54148
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/34863
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://sourceforge.net/mailarchive/forum.php?thread_name=49F61C4E.2040806%40lavrsen.dk&forum_name=foswiki-announce
mailing-listx_refsource_MLISTPatch
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-1432
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50256
vdb-entryx_refsource_XF
https://launchpad.net/bugs/cve/2009-1434
x_refsource_CONFIRM

Link	Providers	Tags
http://foswiki.org/Support/SecurityAlert-CVE-2009-1434		x_refsource_CONFIRMPatchVendor Advisory
http://osvdb.org/54148		vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/34863		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://sourceforge.net/mailarchive/forum.php?thread_name=49F61C4E.2040806%40lavrsen.dk&forum_name=foswiki-announce		mailing-listx_refsource_MLISTPatch
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-1432		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50256		vdb-entryx_refsource_XF
https://launchpad.net/bugs/cve/2009-1434		x_refsource_CONFIRM