[Full-disclosure] [SECURITY] CVE-2011-1026: Apache Archiva Multiple CSRF vulnerability
- From: Deng Ching <oching@xxxxxxxxxx>
- Date: Fri, 27 May 2011 20:20:57 +0800
CVE-2011-1026: Apache Archiva Multiple CSRF vulnerability
Severity: High
Vendor:
The Apache Software Foundation
Versions Affected:
Archiva 1.3.0 - 1.3.4
The unsupported versions Archiva 1.0 - 1.2.2 are also affected.
Description:
An attacker can build a simple html page containing a hidden Image tag
(eg: <img src=vulnurl width=0 height=0 />) and entice the administrator
to access the page.
Mitigation:
Archiva 1.3.4 and earlier users should upgrade to 1.3.5
Credit:
This issue was discovered by Riyaz Ahemed Walikar of Microland Ltd., India
References:
http://archiva.apache.org/security.html
Thanks,
The Apache Archiva Team
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Prev by Date: [Full-disclosure] CfP: ICSEA 2011 || October 23-28, 2011 - Barcelona, Spain
- Next by Date: [Full-disclosure] [SECURITY] CVE-2011-1077: Apache Archiva Multiple XSS vulnerability
- Previous by thread: [Full-disclosure] CfP: ICSEA 2011 || October 23-28, 2011 - Barcelona, Spain
- Next by thread: [Full-disclosure] [SECURITY] CVE-2011-1077: Apache Archiva Multiple XSS vulnerability
- Index(es):
Relevant Pages
|
