PT-2010-1745 · Acollab · Acollab

Publicado 2010-07-22 · Atualizado 2017-08-17 · CVE-2009-4942

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ACollab version 1.2

Description A cross-site request forgery issue allows remote attackers to hijack the authentication of arbitrary users for requests that add personal agenda items.

Recommendations For ACollab version 1.2, consider implementing proper CSRF token validation to prevent unauthorized requests. As a temporary workaround, restrict access to the agenda item addition functionality until a patch is available.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2009-4942

Produtos afetados

Acollab

Referências · 5

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4942 · Nota
• http://holisticinfosec.org/content/view/115/45 · Nota
• http://secunia.com/advisories/35173 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50835 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4942 · Nota de Segurança