Vulnerability CVE-2017-9415

Vulnerability CVE-2017-9415

Published: 2017-07-21

Description:

Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view.

See advisories in our WLB2 database:

	Topic	Author	Date
Med.	Subsonic 6.1.1 Password Reset Cross Site Request Forgery	hyp3rlinx	06.06.2017

Type:

CWE-352

(Cross-Site Request Forgery (CSRF))

CVSS2 => (AV:N/AC:H/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
5.1/10	6.4/10	4.9/10

Exploit range	Attack complexity	Authentication
Remote	High	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Subsonic -> Subsonic

References:

https://www.exploit-db.com/exploits/42117/

Copyright 2024, cxsecurity.com