CVE-2010-3449 Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1; and Apache Continuum....
MediumCVSS 6.8
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1; and Apache Continuum 1.3.6, 1.4.0, and 1.1 through 1.2.3.1; allows remote attackers to hijack the authentication of administrators for requests that modify credentials.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jesse mcconnell redback | <= 1.2.3 | No fix listed |
| jesse mcconnell redback | = 1.0 | No fix listed |
| jesse mcconnell redback | = 1.0-alpha4 | No fix listed |
| jesse mcconnell redback | = 1.0.1 | No fix listed |
| jesse mcconnell redback | = 1.0.2 | No fix listed |
| jesse mcconnell redback | = 1.0.3 | No fix listed |
| jesse mcconnell redback | = 1.1 | No fix listed |
| jesse mcconnell redback | = 1.1.1 | No fix listed |
| jesse mcconnell redback | = 1.1.2 | No fix listed |
| jesse mcconnell redback | = 1.2 | No fix listed |
| jesse mcconnell redback | = 1.2-beta1 | No fix listed |
| jesse mcconnell redback | = 1.2-beta2 | No fix listed |
| jesse mcconnell redback | = 1.2.1 | No fix listed |
| jesse mcconnell redback | = 1.2.2 | No fix listed |
| apache archiva | = 1.0 | No fix listed |
| apache archiva | = 1.0.1 | No fix listed |
| apache archiva | = 1.0.2 | No fix listed |
| apache archiva | = 1.0.3 | No fix listed |
| apache archiva | = 1.1 | No fix listed |
| apache archiva | = 1.1.1 | No fix listed |
| apache archiva | = 1.1.2 | No fix listed |
| apache archiva | = 1.1.3 | No fix listed |
| apache archiva | = 1.1.4 | No fix listed |
| apache archiva | = 1.2 | No fix listed |
| apache archiva | = 1.2.1 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache archiva | = 1.2.2 | No fix listed |
| apache archiva | = 1.3 | No fix listed |
| apache archiva | = 1.3.1 | No fix listed |
References
- archiva.apache.org
- continuum.apache.org
- jira.codehaus.org
- [archiva-users] 20101129 Apache Archiva CSRF Vulnerability mailing-list
- [continuum-users] 20110210 [SECURITY] CVE-2010-3449: Apache Continuum CSRF vulnerability mailing-list
- 20110211 [SECURITY] CVE-2010-3449: Apache Continuum CSRF vulnerability mailing-list
- 42376 third-party-advisory vendor-advisory
- 43261 third-party-advisory
- svn.apache.org patch
- svn.apache.org patch
- svn.apache.org
- svn.apache.org
- 69520 vdb-entry
- 20101129 [CVE-2010-3449] Apache Archiva CSRF Vulnerability mailing-list
- 20110210 [SECURITY] CVE-2010-3449: Apache Continuum CSRF vulnerability mailing-list
- 45095 vdb-entry
- 1025066 vdb-entry
- ADV-2010-3098 vdb-entry vendor-advisory
- ADV-2011-0373 vdb-entry