CVE-2009-4407

Multiple cross-site request forgery (CSRF) vulnerabilities in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote attackers to hijack the authentication of victims for requests that change passwords, and other unspecified requests, via unknown vectors.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/37764	Vendor Advisory
http://www.osvdb.org/61050
http://www.securityfocus.com/archive/1/508478/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/54853
http://secunia.com/advisories/37764	Vendor Advisory
http://www.osvdb.org/61050
http://www.securityfocus.com/archive/1/508478/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/54853

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:pyforum:pyforum::::::::
	cpe:2.3:a:pyforum:pyforum:1.0.0:::::::*
	cpe:2.3:a:pyforum:pyforum:1.0.1:::::::*
	cpe:2.3:a:pyforum:pyforum:1.0.2:::::::*

History

21 Nov 2024, 01:09

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/37764 - Vendor Advisory~~	() http://secunia.com/advisories/37764 - Vendor Advisory
References	~~() http://www.osvdb.org/61050 -~~	() http://www.osvdb.org/61050 -
References	~~() http://www.securityfocus.com/archive/1/508478/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/508478/100/0/threaded -
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/54853 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/54853 -

Information

Published : 2009-12-23 21:30

Updated : 2024-11-21 01:09

NVD link : CVE-2009-4407

Mitre link : CVE-2009-4407

CVE.ORG link : CVE-2009-4407

JSON object : View

Products Affected

pyforum

pyforum

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2009-4407", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": true}]}, "published": "2009-12-23T21:30:00.267", "references": [{"url": "http://secunia.com/advisories/37764", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/61050", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/508478/100/0/threaded", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54853", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/37764", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.osvdb.org/61050", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/508478/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54853", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote attackers to hijack the authentication of victims for requests that change passwords, and other unspecified requests, via unknown vectors."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en PyForum v1.0.3 y probablemente versiones anteriores, y probablemente zForum, permite a atacantes remotos secuestrar la autenticaci\u00f3n de las v\u00edctimas para solicitar el cambio de contrase\u00f1as, y otras solicitudes no especificadas, mediante vectores desconocidos."}], "lastModified": "2024-11-21T01:09:34.300", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pyforum:pyforum:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A142286-A943-4E58-8B80-C6FF73CEE821", "versionEndIncluding": "1.0.3"}, {"criteria": "cpe:2.3:a:pyforum:pyforum:1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D91E4F4-5D7B-4B60-B1C5-255D3FEA8AD2"}, {"criteria": "cpe:2.3:a:pyforum:pyforum:1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "380801DB-032F-4A0C-98F0-766F4B2540D2"}, {"criteria": "cpe:2.3:a:pyforum:pyforum:1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAD9136D-39B6-4A68-9C63-160808688C84"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}