PT-2009-1949 · Parallels · Parallels Virtuozzo

Publicado 2009-03-16 · Atualizado 2018-10-11 · CVE-2008-6479

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Parallels Virtuozzo version 25.4.swsoft (build 3.0.0-25.4.swsoft)

Description A cross-site request forgery (CSRF) issue exists in the "change password" feature of the VZPP web interface, allowing remote attackers to modify passwords by using a link or IMG tag to vz/cp/pwd.

Recommendations For Parallels Virtuozzo version 25.4.swsoft (build 3.0.0-25.4.swsoft), as a temporary workaround, consider disabling the "change password" feature in the VZPP web interface until a patch is available. Restrict access to the vz/cp/pwd endpoint to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-6479

Produtos afetados

Parallels Virtuozzo

Referências · 8

• 🔥 https://exploit-db.com/exploits/31604 · Exploit
• 🔥 http://securityfocus.com/bid/28593 · Exploit
• http://securityfocus.com/archive/1/490409/100/0/threaded · Nota
• http://osvdb.org/44394 · Nota
• http://secunia.com/advisories/29675 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-6479 · Nota de Segurança
• http://px.dynalias.org/files/virtuozzo_pwd.html.txt · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41638 · Nota