CVE-2009-3759

Опубликовано: 22 окт. 2009

Источник: nvd

CVSS3: 8.8

CVSS2: 6

EPSS Низкий

Описание

Multiple cross-site request forgery (CSRF) vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to hijack the authentication of administrators for (1) requests that change the password via the username parameter to config/changepw.php or (2) stop a virtual machine via the stop_vmname parameter to hardstopvm.php. NOTE: some of these details are obtained from third party information.

Ссылки

http://securenetwork.it/ricerca/advisory/download/SN-2009-01.txt
Broken Link
http://securitytracker.com/id?1022520
Broken Link
Third Party Advisory
VDB Entry
http://www.exploit-db.com/exploits/9106
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/504764
Broken Link
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/35592
Broken Link
Exploit
Third Party Advisory
VDB Entry
http://www.vupen.com/english/advisories/2009/1814
Broken Link
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/51576
Third Party Advisory
VDB Entry
http://securenetwork.it/ricerca/advisory/download/SN-2009-01.txt
Broken Link
http://securitytracker.com/id?1022520
Broken Link
Third Party Advisory
VDB Entry
http://www.exploit-db.com/exploits/9106
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/504764
Broken Link
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/35592
Broken Link
Exploit
Third Party Advisory
VDB Entry
http://www.vupen.com/english/advisories/2009/1814
Broken Link
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/51576
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:citrix:xencenterweb:-:*:*:*:*:*:*:*

EPSS

Процентиль: 82%

0.01709

Низкий

8.8 High

CVSS3

6 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-vm5j-fpc2-73xx