CVE-2010-0713

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss 2.3.3, and other versions before 2.5, allow remote attackers to hijack the authentication of an administrator for (1) requests that reset user passwords via zport/dmd/ZenUsers/admin, and (2) requests that change user commands, which allows for remote execution of system commands via zport/dmd/userCommands/.

References

http://www.zenoss.com/news/SQL-Injection-and-Cross-Site-Forgery-in-Zenoss-Core-Corrected.html

http://www.securityfocus.com/archive/1/508982/100/0/threaded

http://www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-002-zenoss-multiple-admin-csrf/

http://secunia.com/advisories/38195

http://osvdb.org/61805

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS