Redback

CSRF vulnerability - Redback does not check which form sends credentials

Details

  • Type: Bug Bug
  • Status: Closed Closed
  • Priority: Critical Critical
  • Resolution: Fixed
  • Affects Version/s: 1.2.3
  • Fix Version/s: 1.2.4
  • Component/s: user management
  • Labels:
    None
  • Number of attachments :
    0

Description

This vulnerability was reported in Archiva. Basically, an attacker can create a specially crafted page and force archiva administrators to view it and change their credentials.

Vulnerability reference key: [CVE-2010-3449] Apache Archiva CSRF Vulnerability

Activity

Hide
Permalink
Maria Odea Ching added a comment -

Fixed in -r915 with the following changes:

  • add a configurable referrer check in security interceptor and enable it by default
  • prompt for system administrator's password on user edit + unit tests
Show
Maria Odea Ching added a comment - Fixed in -r915 with the following changes: add a configurable referrer check in security interceptor and enable it by default prompt for system administrator's password on user edit + unit tests

People

  • Assignee:
    Maria Odea Ching
    Reporter:
    Maria Odea Ching
Vote (0)
Watch (0)

Dates

  • Created:
    Updated:
    Resolved: