CVEvulnerability
CVE-2011-1364
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-10-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Cross-site request forgery (CSRF) vulnerability in _ah/admin/interactive/execute (aka the Interactive Console) in the SDK Console (aka Admin Console) in the Google App Engine Python SDK before 1.5.4 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary Python code via the code parameter.
Affected configurations
• google app engine python sdk (<= 1.5.3)
• google app engine python sdk 1.0.1
• google app engine python sdk 1.0.2
• google app engine python sdk 1.1.0
• google app engine python sdk 1.1.1
• google app engine python sdk 1.1.2
• google app engine python sdk 1.1.3
• google app engine python sdk 1.1.4
• google app engine python sdk 1.1.5
• google app engine python sdk 1.1.6
• google app engine python sdk 1.1.7
• google app engine python sdk 1.1.8
• google app engine python sdk 1.1.9
• google app engine python sdk 1.2.0
• google app engine python sdk 1.2.1
• google app engine python sdk 1.2.2
• google app engine python sdk 1.2.3
• google app engine python sdk 1.2.4
• google app engine python sdk 1.2.5
• google app engine python sdk 1.2.6
• google app engine python sdk 1.2.7
• google app engine python sdk 1.3.0
• google app engine python sdk 1.3.1
• google app engine python sdk 1.3.2
• google app engine python sdk 1.3.3
• google app engine python sdk 1.3.4
• google app engine python sdk 1.3.5
• google app engine python sdk 1.3.6
• google app engine python sdk 1.3.7
• google app engine python sdk 1.3.8
• google app engine python sdk 1.4.0
• google app engine python sdk 1.4.1
• google app engine python sdk 1.4.2
• google app engine python sdk 1.4.3
• google app engine python sdk 1.5.0
• google app engine python sdk 1.5.1
• google app engine python sdk 1.5.2
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://blog.watchfire.com/files/googleappenginesdk.pdf Exploit
- http://code.google.com/p/googleappengine/wiki/SdkReleaseNotes Patch
- http://www.securityfocus.com/bid/50075 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69958 exchange.xforce.ibmcloud.com
- http://blog.watchfire.com/files/googleappenginesdk.pdf Exploit
- http://code.google.com/p/googleappengine/wiki/SdkReleaseNotes Patch
- http://www.securityfocus.com/bid/50075 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69958 exchange.xforce.ibmcloud.com