QwikSec

Security Database

CVE

CWE

Training

CVE-2009-4898

Published: Sep 7, 2010

Modified: Sep 16, 2024

PUBLISHED

Description

Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.2 allows remote attackers to hijack the authentication of arbitrary users for requests that update pages, as demonstrated by a URL for a save script in the ACTION attribute of a FORM element, in conjunction with a call to the submit method in the onload attribute of a BODY element. NOTE: this issue exists because of an insufficient fix for CVE-2009-1339.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

[oss-security] 20100803 CVE 2009 request: twiki before 4.3.2 CSRF

mailing-list

x_refsource_MLIST

[oss-security] 20100803 Re: CVE 2009 request: twiki before 4.3.2 CSRF

mailing-list

x_refsource_MLIST

http://twiki.org/cgi-bin/view/Codev/SecurityAuditTokenBasedCsrfFix

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.