Apache Roller 4.x / 5.x Cross Site Request Forgery

2012-06-26 / 2012-08-15
Credit: Jun Zhu
Risk: Low
Local: No
Remote: Yes
CVE: CVE-2012-2380
CWE: CWE-352


CVSS Base Score: 9.3/10
Impact Subscore: 10/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

Severity: important Vendor: The Apache Software Foundation Versions Affected: Roller 4.0.0 to Roller 4.0.1 Roller 5.0 The unsupported Roller 3.1 release is also affected Description: HTTP POST interfaces in the Roller admin/editor console were not protected from CSRF attacks. This issue has been fixed by requiring a valid per user and per session "salt" value in all HTTP POST requests. Mitigation Roller 4.0 and 4.0.1 users should upgrade to Roller 5.0.1 Roller 5.0 users should upgrade to Roller 5.0.1 Roller 3.1 users should upgrade to Roller 5.0.1 Credit: This issue was discovered by Jun Zhu, PhD student, University of North Carolina, Charlotte

References:

http://packetstormsecurity.org/files/114168/CVE-2012-2380.txt


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top