PT-2009-5928 · Unknown · Shared Sign-On

Published 2009-10-09 · Updated 2017-08-17 · CVE-2009-3656

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Shared Sign-On versions 5.x through 6.x

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of arbitrary users. This is achieved via unknown vectors, potentially allowing for unauthorized access to user accounts.

Recommendations For versions 5.x through 6.x, update to a version that includes a fix for this issue to prevent CSRF attacks.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2009-3656

Affected Products

Shared Sign-On

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2009-3656 · Security Note
• http://drupal.org/node/592488 · Vendor Advisory
• http://securityfocus.com/bid/36563 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53559 · Note