PT-2009-1949 · Parallels · Parallels Virtuozzo

Published 2009-03-16 · Updated 2018-10-11 · CVE-2008-6479

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Parallels Virtuozzo version 25.4.swsoft (build 3.0.0-25.4.swsoft)

Description A cross-site request forgery (CSRF) issue exists in the "change password" feature of the VZPP web interface, allowing remote attackers to modify passwords by using a link or IMG tag to vz/cp/pwd.

Recommendations For Parallels Virtuozzo version 25.4.swsoft (build 3.0.0-25.4.swsoft), as a temporary workaround, consider disabling the "change password" feature in the VZPP web interface until a patch is available. Restrict access to the vz/cp/pwd endpoint to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-6479

Affected Products

Parallels Virtuozzo

References · 8

• 🔥 https://exploit-db.com/exploits/31604 · Exploit
• 🔥 http://securityfocus.com/bid/28593 · Exploit
• http://secunia.com/advisories/29675 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6479 · Security Note
• http://securityfocus.com/archive/1/490409/100/0/threaded · Note
• http://osvdb.org/44394 · Note
• http://px.dynalias.org/files/virtuozzo_pwd.html.txt · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41638 · Note