PT-2010-2389 · Kessler Consulting · Webcalendar

Published 2010-02-12 · Updated 2012-10-13 · CVE-2010-0637

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebCalendar versions 1.2.0 through 1.2.5

Description The issue allows remote attackers to hijack the authentication of administrators for requests, including deleting an event or banning an IP address from posting.

Recommendations For WebCalendar versions 1.2.0 through 1.2.5, update to a version newer than 1.2.5 to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2010-0637

Affected Products

Webcalendar

References · 4

• http://secunia.com/advisories/38222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0637 · Security Note
• http://webcalendar.cvs.sourceforge.net/viewvc/webcalendar/webcalendar/ChangeLog?pathrev=REL_1_2 · Note
• http://holisticinfosec.org/content/view/133/45 · Note