6.8

CVE-2013-1088

Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Novell ≫ Imanager Updatesp6 Version <= 2.7
Novell ≫ Imanager Version2.7
Novell ≫ Imanager Version2.7 Updaterefresh6
Novell ≫ Imanager Version2.7 Updatesp4
Novell ≫ Imanager Version2.7 Updatesp4_patch1
Novell ≫ Imanager Version2.7 Updatesp4_patch2
Novell ≫ Imanager Version2.7 Updatesp4_patch3
Novell ≫ Imanager Version2.7 Updatesp4_patch4
Novell ≫ Imanager Version2.7 Updatesp5
Novell ≫ Imanager Version2.7.1
Novell ≫ Imanager Version2.7.2
Novell ≫ Imanager Version2.7.3
Novell ≫ Imanager Version2.7.3 Updateftf2
Novell ≫ Imanager Version2.7.3 Updateftf4
Novell ≫ Imanager Version2.7.3 Updatesp3
Novell ≫ Imanager Version2.7.4
Novell ≫ Imanager Version2.7.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.59% 0.666
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.