CVE-2013-7107

Опубликовано: 15 янв. 2014

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in cmd.cgi in Icinga 1.8.5, 1.9.4, 1.10.2, and earlier allows remote attackers to hijack the authentication of users for unspecified commands via unspecified vectors, as demonstrated by bypassing authentication requirements for CVE-2013-7106.

Ссылки

http://lists.opensuse.org/opensuse-updates/2014-02/msg00061.html
http://www.openwall.com/lists/oss-security/2013/12/16/4
https://dev.icinga.org/issues/5250
Vendor Advisory
https://dev.icinga.org/issues/5346
Vendor Advisory
https://www.icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5/
Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2014-02/msg00061.html
http://www.openwall.com/lists/oss-security/2013/12/16/4
https://dev.icinga.org/issues/5250
Vendor Advisory
https://dev.icinga.org/issues/5346
Vendor Advisory
https://www.icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*

Версия до 1.10.2 (включая)

cpe:2.3:a:icinga:icinga:0.8.0:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:0.8.1:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:0.8.2:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:0.8.3:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:0.8.4:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.0:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.0:rc1:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.0.2:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.0.3:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.2.1:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.3.1:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.4.1:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.6.0:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.6.1:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.6.2:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.7.0:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.7.1:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.7.2:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.7.3:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.7.4:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.8.0:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.8.1:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.8.2:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.8.3:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.8.4:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.8.5:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.9.0:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.9.1:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.9.2:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.9.3:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.9.4:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.10.0:*:*:*:*:*:*:*

cpe:2.3:a:icinga:icinga:1.10.1:*:*:*:*:*:*:*

EPSS

Процентиль: 33%

0.00128

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

CVE-2013-7107

ubuntu

около 12 лет назад

CVE-2013-7107

debian

около 12 лет назад

Cross-site request forgery (CSRF) vulnerability in cmd.cgi in Icinga 1 ...

GHSA-967x-cpx9-7xr2

github

больше 3 лет назад

BDU:2015-03479

fstec

около 12 лет назад

Уязвимости операционной системы Debian GNU/Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

EPSS

Процентиль: 33%

0.00128

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352