← Zuruck zu CVEs
CVE-2009-3759
HIGH8.8
Beschreibung
Multiple cross-site request forgery (CSRF) vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to hijack the authentication of administrators for (1) requests that change the password via the username parameter to config/changepw.php or (2) stop a virtual machine via the stop_vmname parameter to hardstopvm.php. NOTE: some of these details are obtained from third party information.
CVE Details
CVSS v3.1 Bewertung8.8
SchweregradHIGH
CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AngriffsvektorNETWORK
KomplexitatLOW
Erforderliche PrivilegienNONE
BenutzerinteraktionREQUIRED
Veroffentlicht10/22/2009
Zuletzt geandert4/23/2026
Quellenvd
Honeypot-Sichtungen0
Betroffene Produkte
citrix:xencenterweb
Schwachen (CWE)
CWE-352
Referenzen
http://securitytracker.com/id?1022520(cve@mitre.org)
http://www.exploit-db.com/exploits/9106(cve@mitre.org)
http://www.securityfocus.com/archive/1/504764(cve@mitre.org)
http://www.securityfocus.com/bid/35592(cve@mitre.org)
http://www.vupen.com/english/advisories/2009/1814(cve@mitre.org)
https://exchange.xforce.ibmcloud.com/vulnerabilities/51576(cve@mitre.org)
http://securenetwork.it/ricerca/advisory/download/SN-2009-01.txt(af854a3a-2127-422b-91ae-364da2661108)
http://securitytracker.com/id?1022520(af854a3a-2127-422b-91ae-364da2661108)
http://www.exploit-db.com/exploits/9106(af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/504764(af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/35592(af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/1814(af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/51576(af854a3a-2127-422b-91ae-364da2661108)
IOC Korrelationen
Keine Korrelationen erfasst
This product uses data from the NVD API but is not endorsed or certified by the NVD.