PT-2009-5863 · Sql Ledger+1 · Sql-Ledger+1

Published 2009-12-23 · Updated 2018-10-10 · CVE-2009-3580

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SQL-Ledger version 2.8.24

Description A cross-site request forgery issue allows remote attackers to hijack user authentication for password change requests. This is achieved by manipulating the login, new password, and confirm password parameters in a preferences action.

Recommendations For SQL-Ledger version 2.8.24, consider disabling the password change functionality via the preferences action until a patch is available. Restrict access to the affected am.pl script to minimize the risk of exploitation. Avoid using the login, new password, and confirm password parameters in the preferences action until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2009-3580

Affected Products

Debian

Sql-Ledger

References · 13

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3580 · Security Note
• https://ubuntu.com/security/CVE-2009-3580 · Vendor Advisory
• http://secunia.com/advisories/37877 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3580 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/sql-ledger · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3580 · Security Note
• https://cve.org/CVERecord?id=CVE-2009-3580 · Security Note
• https://osv.dev/vulnerability/CVE-2009-3580 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-3580 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2009-3580 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54964 · Note
• http://securityfocus.com/archive/1/508559/100/0/threaded · Note
• https://packages.debian.org/src:sql-ledger · Note