Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.securityfocus.com/archive/1/518465/100/0/threaded | mailing-list x_refsource_BUGTRAQ |
| http://www.coresecurity.com/content/IBM-WebSphere-CSRF | x_refsource_MISC |
| http://www.securityfocus.com/bid/48305 | vdb-entry x_refsource_BID |
| http://www.exploit-db.com/exploits/17404 | exploit x_refsource_EXPLOIT-DB |
| http://securityreason.com/securityalert/8281 | third-party-advisory x_refsource_SREASON |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.securityfocus.com/archive/1/518465/100/0/threaded | mailing-list x_refsource_BUGTRAQ x_transferred |
| http://www.coresecurity.com/content/IBM-WebSphere-CSRF | x_refsource_MISC x_transferred |
| http://www.securityfocus.com/bid/48305 | vdb-entry x_refsource_BID x_transferred |
| http://www.exploit-db.com/exploits/17404 | exploit x_refsource_EXPLOIT-DB x_transferred |
| http://securityreason.com/securityalert/8281 | third-party-advisory x_refsource_SREASON x_transferred |
Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 6.8 | MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| Hyperlink | Source | Resource |
|---|---|---|
| http://securityreason.com/securityalert/8281 | cve@mitre.org | N/A |
| http://www.coresecurity.com/content/IBM-WebSphere-CSRF | cve@mitre.org | Exploit |
| http://www.exploit-db.com/exploits/17404 | cve@mitre.org | Exploit |
| http://www.securityfocus.com/archive/1/518465/100/0/threaded | cve@mitre.org | N/A |
| http://www.securityfocus.com/bid/48305 | cve@mitre.org | N/A |
| http://securityreason.com/securityalert/8281 | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://www.coresecurity.com/content/IBM-WebSphere-CSRF | af854a3a-2127-422b-91ae-364da2661108 | Exploit |
| http://www.exploit-db.com/exploits/17404 | af854a3a-2127-422b-91ae-364da2661108 | Exploit |
| http://www.securityfocus.com/archive/1/518465/100/0/threaded | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://www.securityfocus.com/bid/48305 | af854a3a-2127-422b-91ae-364da2661108 | N/A |