6.8

CVE-2010-3449

Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1; and Apache Continuum 1.3.6, 1.4.0, and 1.1 through 1.2.3.1; allows remote attackers to hijack the authentication of administrators for requests that modify credentials.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jesse Mcconnell ≫ Redback Version <= 1.2.3
Jesse Mcconnell ≫ Redback Version1.0
Jesse Mcconnell ≫ Redback Version1.0 Updatealpha4
Jesse Mcconnell ≫ Redback Version1.0.1
Jesse Mcconnell ≫ Redback Version1.0.2
Jesse Mcconnell ≫ Redback Version1.0.3
Jesse Mcconnell ≫ Redback Version1.1
Jesse Mcconnell ≫ Redback Version1.1.1
Jesse Mcconnell ≫ Redback Version1.1.2
Jesse Mcconnell ≫ Redback Version1.2
Jesse Mcconnell ≫ Redback Version1.2 Updatebeta1
Jesse Mcconnell ≫ Redback Version1.2 Updatebeta2
Jesse Mcconnell ≫ Redback Version1.2.1
Jesse Mcconnell ≫ Redback Version1.2.2
Apache ≫ Archiva Version1.0
Apache ≫ Archiva Version1.0.1
Apache ≫ Archiva Version1.0.2
Apache ≫ Archiva Version1.0.3
Apache ≫ Archiva Version1.1
Apache ≫ Archiva Version1.1.1
Apache ≫ Archiva Version1.1.2
Apache ≫ Archiva Version1.1.3
Apache ≫ Archiva Version1.1.4
Apache ≫ Archiva Version1.2
Apache ≫ Archiva Version1.2.1
Apache ≫ Archiva Version1.2.2
Apache ≫ Archiva Version1.3
Apache ≫ Archiva Version1.3.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.24% 0.839
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.