← Volver a CVEs

CVE-2009-3759

HIGH

8.8

Descripcion

Multiple cross-site request forgery (CSRF) vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to hijack the authentication of administrators for (1) requests that change the password via the username parameter to config/changepw.php or (2) stop a virtual machine via the stop_vmname parameter to hardstopvm.php. NOTE: some of these details are obtained from third party information.

Detalles CVE

Puntuacion CVSS v3.18.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado10/22/2009

Ultima modificacion4/23/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

citrix:xencenterweb

Debilidades (CWE)

CWE-352

Referencias

http://securenetwork.it/ricerca/advisory/download/SN-2009-01.txt(cve@mitre.org)

http://securitytracker.com/id?1022520(cve@mitre.org)

http://www.exploit-db.com/exploits/9106(cve@mitre.org)

http://www.securityfocus.com/archive/1/504764(cve@mitre.org)

http://www.securityfocus.com/bid/35592(cve@mitre.org)

http://www.vupen.com/english/advisories/2009/1814(cve@mitre.org)

https://exchange.xforce.ibmcloud.com/vulnerabilities/51576(cve@mitre.org)

http://securenetwork.it/ricerca/advisory/download/SN-2009-01.txt(af854a3a-2127-422b-91ae-364da2661108)

http://securitytracker.com/id?1022520(af854a3a-2127-422b-91ae-364da2661108)

http://www.exploit-db.com/exploits/9106(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/archive/1/504764(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/35592(af854a3a-2127-422b-91ae-364da2661108)

http://www.vupen.com/english/advisories/2009/1814(af854a3a-2127-422b-91ae-364da2661108)

https://exchange.xforce.ibmcloud.com/vulnerabilities/51576(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.