CVE-2010-5085

Multiple cross-site request forgery (CSRF) vulnerabilities in admin/update_user in Hulihan Amethyst 0.1.5, and possibly earlier, allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrative password or (2) change the site's configuration.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://dev.hulihanapplications.com/issues/show/208	Exploit
http://marc.info/?l=bugtraq&m=128104795219200&w=2	Exploit
http://secunia.com/advisories/40874	Vendor Advisory
http://www.htbridge.ch/advisory/xsrf_csrf_in_amethyst.html	Exploit
http://www.osvdb.org/67043
http://www.vupen.com/english/advisories/2010/2022	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/60947

Configurations

Configuration 1 (hide)

cpe:2.3:a:hulihanapplications:amethyst:0.1.5:*:*:*:*:*:*:*

History

No history.

Information

Published : 2012-02-14 20:55

Updated : 2024-02-28 11:41

NVD link : CVE-2010-5085

Mitre link : CVE-2010-5085

CVE.ORG link : CVE-2010-5085

JSON object : View

Products Affected

hulihanapplications

amethyst

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2010-5085", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2012-02-14T20:55:04.423", "references": [{"url": "http://dev.hulihanapplications.com/issues/show/208", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=128104795219200&w=2", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/40874", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.htbridge.ch/advisory/xsrf_csrf_in_amethyst.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/67043", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2010/2022", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60947", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in admin/update_user in Hulihan Amethyst 0.1.5, and possibly earlier, allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrative password or (2) change the site's configuration."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en admin/update_user en Hulihan Amethyst v0.1.5, y posiblemente anteriores, permite a atacantes remotos secuestrar la autenticaci\u00f3n de administradores en peticiones que (1) cambian la contrase\u00f1a administrativa o (2) cambian la configuraci\u00f3n del sitio."}], "lastModified": "2017-08-29T01:29:12.847", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hulihanapplications:amethyst:0.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2864EF6-E738-40C0-89B0-3016C365D34F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}