CVEvulnerability
CVE-2009-1434
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-04-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Cross-site request forgery (CSRF) vulnerability in Foswiki before 1.0.5 allows remote attackers to hijack the authentication of arbitrary users for requests that modify pages, change permissions, or change group memberships, as demonstrated by a URL for a (1) save or (2) view script in the SRC attribute of an IMG element, a related issue to CVE-2009-1339.
Affected configurations
• foswiki foswiki (<= 1.0.4)
• foswiki foswiki 1.0.0
• foswiki foswiki 1.0.1
• foswiki foswiki 1.0.2
• foswiki foswiki 1.0.3
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://foswiki.org/Support/SecurityAlert-CVE-2009-1434 Patch, Vendor Advisory
- http://osvdb.org/54148 osvdb.org
- http://secunia.com/advisories/34863 Vendor Advisory
- http://sourceforge.net/mailarchive/forum.php?thread_name=49F61C4E.2040806%40lavrsen.dk&forum_name=foswiki-announce Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50256 exchange.xforce.ibmcloud.com
- https://launchpad.net/bugs/cve/2009-1434 launchpad.net
- http://foswiki.org/Support/SecurityAlert-CVE-2009-1434 Patch, Vendor Advisory
- http://osvdb.org/54148 osvdb.org
- http://secunia.com/advisories/34863 Vendor Advisory
- http://sourceforge.net/mailarchive/forum.php?thread_name=49F61C4E.2040806%40lavrsen.dk&forum_name=foswiki-announce Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50256 exchange.xforce.ibmcloud.com
- https://launchpad.net/bugs/cve/2009-1434 launchpad.net