PT-2008-6261 · Sun · Sun Java System Identity Manager

Publicado 2008-11-18 · Atualizado 2018-10-11 · CVE-2008-5115

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager versions 6.0 through 6.0 SP4 Sun Java System Identity Manager version 7.0 Sun Java System Identity Manager version 7.1

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that update the password via the "idm/admin/changeself.jsp" endpoint.

Recommendations For Sun Java System Identity Manager versions 6.0 through 6.0 SP4, consider restricting access to the "idm/admin/changeself.jsp" endpoint until a fix is available. For Sun Java System Identity Manager version 7.0, consider restricting access to the "idm/admin/changeself.jsp" endpoint until a fix is available. For Sun Java System Identity Manager version 7.1, consider restricting access to the "idm/admin/changeself.jsp" endpoint until a fix is available.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-5115

Produtos afetados

Sun Java System Identity Manager

Referências · 11

• 🔥 https://exploit-db.com/exploits/32579 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5115 · Nota de Segurança
• http://securityfocus.com/bid/32262 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46553 · Nota
• http://securitytracker.com/id?1021170 · Nota
• http://vupen.com/english/advisories/2008/3128 · Nota
• http://procheckup.com/vulnerability_manager/vulnerabilities/pr07-11 · Nota
• http://securityfocus.com/archive/1/498479/100/0/threaded · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-243386-1 · Aviso do Fabricante
• http://osvdb.org/49766 · Nota
• http://secunia.com/advisories/32606 · Aviso do Fabricante