CVEvulnerability
CVE-2010-0713
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-02-26
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss 2.3.3, and other versions before 2.5, allow remote attackers to hijack the authentication of an administrator for (1) requests that reset user passwords via zport/dmd/ZenUsers/admin, and (2) requests that change user commands, which allows for remote execution of system commands via zport/dmd/userCommands/.
Affected configurations
• zenoss zenoss (<= 2.4.5)
• zenoss zenoss 2.3.0
• zenoss zenoss 2.3.3
• zenoss zenoss 2.4.0
• zenoss zenoss 2.4.2
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://osvdb.org/61805 osvdb.org
- http://secunia.com/advisories/38195 Vendor Advisory
- http://www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-002-zenoss-multiple-admin-csrf/ www.ngenuity.org
- http://www.securityfocus.com/archive/1/508982/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/37843 Exploit
- http://www.zenoss.com/news/SQL-Injection-and-Cross-Site-Forgery-in-Zenoss-Core-Corrected.html Vendor Advisory
- http://osvdb.org/61805 osvdb.org
- http://secunia.com/advisories/38195 Vendor Advisory
- http://www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-002-zenoss-multiple-admin-csrf/ www.ngenuity.org
- http://www.securityfocus.com/archive/1/508982/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/37843 Exploit
- http://www.zenoss.com/news/SQL-Injection-and-Cross-Site-Forgery-in-Zenoss-Core-Corrected.html Vendor Advisory