6.8

CVE-2009-1290

Exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration interface in the Advanced Management Module (AMM) on the IBM BladeCenter, including the BladeCenter H with BPET36H 54, allow remote attackers to hijack the authentication of administrators, as demonstrated by a power-off request to the private/blade_power_action script.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Advanced Management Module Version 1.36h
   Ibm ≫ Bladecenter Version e Edition 1881
   Ibm ≫ Bladecenter Version e Edition 7967
   Ibm ≫ Bladecenter Version e Edition 8677
   Ibm ≫ Bladecenter Version h Edition 7989
   Ibm ≫ Bladecenter Version h Edition 8852
   Ibm ≫ Bladecenter Version hc10 Edition 7996
   Ibm ≫ Bladecenter Version hs12 Edition 1916
   Ibm ≫ Bladecenter Version hs12 Edition 8014
   Ibm ≫ Bladecenter Version hs12 Edition 8028
   Ibm ≫ Bladecenter Version hs20 Edition 1883
   Ibm ≫ Bladecenter Version hs21 Edition 1885
   Ibm ≫ Bladecenter Version hs21 Edition 8853
   Ibm ≫ Bladecenter Version hs21_xm Edition 1915
   Ibm ≫ Bladecenter Version hs21_xm Edition 7995
   Ibm ≫ Bladecenter Version ht Edition 8740
   Ibm ≫ Bladecenter Version ht Edition 8750
   Ibm ≫ Bladecenter Version js12 Edition 7998
   Ibm ≫ Bladecenter Version js21 Edition 7988
   Ibm ≫ Bladecenter Version js21 Edition 8844
   Ibm ≫ Bladecenter Version js22 Edition 7998
   Ibm ≫ Bladecenter Version ls20 Edition 8850
   Ibm ≫ Bladecenter Version ls21 Edition 7971
   Ibm ≫ Bladecenter Version ls41 Edition 7972
   Ibm ≫ Bladecenter Version qs21 Edition 0792
   Ibm ≫ Bladecenter Version qs22 Edition 0793
   Ibm ≫ Bladecenter Version s Edition 1948
   Ibm ≫ Bladecenter Version s Edition 8886
   Ibm ≫ Bladecenter Version t Edition 8720
   Ibm ≫ Bladecenter Version t Edition 8730
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.98% 0.577
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://securitytracker.com/id?1022025
http://www.louhinetworks.fi/advisory/ibm_090409.txt
http://www.securityfocus.com/archive/1/502582/100/0/threaded
http://www.securityfocus.com/bid/34447
Exploit
http://osvdb.org/53660