CVE-2008-5115 Cross-site request forgery (CSRF) vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to hijack the authentication of administrators for request...
MediumCVSS 6.8
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to hijack the authentication of administrators for requests that update the password via idm/admin/changeself.jsp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sun java system identity manager | = 6.0 | No fix listed |
| sun java system identity manager | = 6.0-sp1 | No fix listed |
| sun java system identity manager | = 6.0-sp2 | No fix listed |
| sun java system identity manager | = 6.0-sp3 | No fix listed |
| sun java system identity manager | = 6.0-sp4 | No fix listed |
| sun java system identity manager | = 7.0 | No fix listed |
| sun java system identity manager | = 7.1 | No fix listed |
References
- 49766 vdb-entry
- 32606 third-party-advisory vendor-advisory
- 243386 patch vendor-advisory
- www.procheckup.com
- 20081119 PR07-11: Cross-site Request Forgery (CSRF) on Sun Java System Identity Manager mailing-list
- 32262 vdb-entry
- 1021170 vdb-entry
- ADV-2008-3128 vdb-entry
- sun-jsim-unspecified-csrf(46553) vdb-entry