PT-2010-3854 · Accoria · Accoria Web Server

Ilja Van Sprundel · Published 2010-06-14 · Updated 2010-06-16 · CVE-2010-2268

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Accoria Web Server (aka Rock Web Server) version 1.4.7

Description A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack administrator authentication for requests that create user accounts.

Recommendations For Accoria Web Server (aka Rock Web Server) version 1.4.7, consider implementing CSRF protection mechanisms, such as token-based validation, to prevent unauthorized requests. As a temporary workaround, restrict access to the authcfg.cgi script to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2010-2268

Affected Products

Accoria Web Server

References · 3

• 🔥 http://ioactive.com/pdfs/AccoriaWebServer.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-2268 · Security Note
• http://kb.cert.org/vuls/id/245081 · Note