PT-2010-4824 · Apache+1 · Apache Continuum+2

Published 2010-12-06 · Updated 2018-10-10 · CVE-2010-3449

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Redback versions prior to 1.2.4 Apache Archiva versions 1.0 through 1.0.3 Apache Archiva versions 1.1 through 1.1.4 Apache Archiva versions 1.2 through 1.2.2 Apache Archiva versions 1.3 through 1.3.1 Apache Continuum version 1.3.6 Apache Continuum version 1.4.0 Apache Continuum versions 1.1 through 1.2.3.1

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that modify credentials. This can lead to unauthorized changes to credentials.

Recommendations For Redback versions prior to 1.2.4, update to version 1.2.4 or later. For Apache Archiva versions 1.0 through 1.0.3, update to a version outside of this range. For Apache Archiva versions 1.1 through 1.1.4, update to a version outside of this range. For Apache Archiva versions 1.2 through 1.2.2, update to a version outside of this range. For Apache Archiva versions 1.3 through 1.3.1, update to a version outside of this range. For Apache Continuum version 1.3.6, update to a version outside of this range. For Apache Continuum version 1.4.0, update to a version outside of this range. For Apache Continuum versions 1.1 through 1.2.3.1, update to a version outside of this range.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2010-3449

Affected Products

Apache Archiva

Apache Continuum

Redback

References · 22

• 🔥 https://exploit-db.com/exploits/15710 · Exploit
• http://secunia.com/advisories/42376 · Vendor Advisory
• http://svn.apache.org/viewvc/archiva/branches/archiva-1.3.x/pom.xml?r1=1038518&r2=1038517&pathrev=1038518 · Patch
• http://vupen.com/english/advisories/2010/3098 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3449 · Security Note
• http://svn.apache.org/viewvc/archiva/branches/archiva-1.3.x/archiva-modules/archiva-web/archiva-webapp/src/main/resources/struts.xml?r1=1038518&r2=1038517&pathrev=1038518 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3449 · Note
• http://jira.codehaus.org/browse/MRM-1438 · Note
• http://securityfocus.com/bid/45095 · Note
• http://svn.apache.org/viewvc?view=revision&revision=1066010 · Note
• http://archiva.apache.org/security.html · Note
• http://secunia.com/advisories/43261 · Note
• http://osvdb.org/69520 · Note
• http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C032C189E-D821-4833-A8F2-F72365147695%40apache.org%3E · Note
• http://svn.apache.org/viewvc?view=revision&revision=1038518 · Note