PT-2009-1948 · Parallels · Parallels Virtuozzo

Published 2009-03-16 · Updated 2018-10-11 · CVE-2008-6478

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Parallels Virtuozzo versions 3.0.0-25.4.swsoft through 4.0.0-365.6.swsoft

Description A cross-site request forgery (CSRF) issue exists in the file manager of the VZPP web interface, allowing remote attackers to create and delete arbitrary files as the administrator. This can be achieved via a link or IMG tag to specific API endpoints, such as "vz/cp/vzdir/infrman/envs/files/" for creating files and modifying system configuration through the path parameter.

Recommendations For versions 3.0.0-25.4.swsoft through 4.0.0-365.6.swsoft, consider disabling access to the file manager in the VZPP web interface until a patch is available. Restrict access to the vz/cp/vzdir/infrman/envs/files/ endpoint to minimize the risk of exploitation. Avoid using the path parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-6478

Affected Products

Parallels Virtuozzo

References · 8

• 🔥 https://exploit-db.com/exploits/31603 · Exploit
• 🔥 http://securityfocus.com/bid/28589 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6478 · Security Note
• http://secunia.com/advisories/29675 · Vendor Advisory
• http://securityfocus.com/archive/1/490409/100/0/threaded · Note
• http://px.dynalias.org/files/virtuozzo_overwrite.html.txt · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41640 · Note
• http://osvdb.org/44395 · Note