CVE-2009-4898
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.2 allows remote attackers to hijack the authentication of arbitrary users for requests that update pages, as demonstrated by a URL for a save script in the ACTION attribute of a FORM element, in conjunction with a call to the submit method in the onload attribute of a BODY element. NOTE: this issue exists because of an insufficient fix for CVE-2009-1339.
Una vulnerabilidad de Falsificación de petición en sitios cruzados (CSRF) en TWiki antes de v4.3.2 permite a atacantes remotos secuestrar la autenticación de cualquier usuario que soliciten actualizar una página, como lo demuestra una dirección URL para guardar un script en el atributo ACTION de un elemento FORM, junto con una llamada al método submit en el atributo onload de un elemento BODY. NOTA: este problema existe debido a una resolución incompleta al CVE-2009-1339.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2010-06-15 CVE Reserved
- 2010-09-07 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://twiki.org/cgi-bin/view/Codev/SecurityAuditTokenBasedCsrfFix | X_refsource_confirm | |
| http://www.openwall.com/lists/oss-security/2010/08/02/17 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2010/08/03/8 | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | <= 4.3.1 Search vendor "Twiki" for product "Twiki" and version " <= 4.3.1" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.0.0 Search vendor "Twiki" for product "Twiki" and version "4.0.0" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.0.1 Search vendor "Twiki" for product "Twiki" and version "4.0.1" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.0.2 Search vendor "Twiki" for product "Twiki" and version "4.0.2" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.0.3 Search vendor "Twiki" for product "Twiki" and version "4.0.3" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.0.4 Search vendor "Twiki" for product "Twiki" and version "4.0.4" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.0.5 Search vendor "Twiki" for product "Twiki" and version "4.0.5" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.1.0 Search vendor "Twiki" for product "Twiki" and version "4.1.0" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.1.1 Search vendor "Twiki" for product "Twiki" and version "4.1.1" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.1.2 Search vendor "Twiki" for product "Twiki" and version "4.1.2" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.2.0 Search vendor "Twiki" for product "Twiki" and version "4.2.0" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.2.1 Search vendor "Twiki" for product "Twiki" and version "4.2.1" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.2.2 Search vendor "Twiki" for product "Twiki" and version "4.2.2" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.2.3 Search vendor "Twiki" for product "Twiki" and version "4.2.3" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.2.4 Search vendor "Twiki" for product "Twiki" and version "4.2.4" | - |
Affected
| ||||||
| Twiki Search vendor "Twiki" | Twiki Search vendor "Twiki" for product "Twiki" | 4.3.0 Search vendor "Twiki" for product "Twiki" and version "4.3.0" | - |
Affected
| ||||||