PT-2009-5863 · Sql Ledger+1 · Sql-Ledger+1

Publicado 2009-12-23 · Atualizado 2018-10-10 · CVE-2009-3580

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SQL-Ledger version 2.8.24

Description A cross-site request forgery issue allows remote attackers to hijack user authentication for password change requests. This is achieved by manipulating the login, new password, and confirm password parameters in a preferences action.

Recommendations For SQL-Ledger version 2.8.24, consider disabling the password change functionality via the preferences action until a patch is available. Restrict access to the affected am.pl script to minimize the risk of exploitation. Avoid using the login, new password, and confirm password parameters in the preferences action until the issue is resolved.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2009-3580

Produtos afetados

Debian

Sql-Ledger

Referências · 13

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3580 · Nota de Segurança
• https://ubuntu.com/security/CVE-2009-3580 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54964 · Nota
• http://secunia.com/advisories/37877 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3580 · Aviso do Fabricante
• http://securityfocus.com/archive/1/508559/100/0/threaded · Nota
• https://security-tracker.debian.org/tracker/source-package/sql-ledger · Aviso do Fabricante
• https://packages.debian.org/src:sql-ledger · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3580 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2009-3580 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2009-3580 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-3580 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2009-3580 · Aviso do Fabricante