CVE-2011-0650 Cross-site request forgery (CSRF) vulnerability in Greenbone Security Assistant (GSA) before 2.0+rc3 allows remote attackers to hijack the authentication of users for requests that send email via an O...
MediumCVSS 6.8
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in Greenbone Security Assistant (GSA) before 2.0+rc3 allows remote attackers to hijack the authentication of users for requests that send email via an OMP request to OpenVAS Manager. NOTE: this issue can be leveraged to bypass authentication requirements for exploiting CVE-2011-0018.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| greenbone security assistant | <= 2.0 | No fix listed |
References
- 43092 not-applicable third-party-advisory
- www.openvas.org third-party-advisory
- 20110125 [OVSA20110118] OpenVAS Manager Vulnerable To Command Injection mailing-list
- greenbone-unspecifed-csrf(65012) vdb-entry
- [openvas-commits] 20110203 r10151 - in trunk/gsa: . src src/html mailing-list
- [openvas-commits] 20110203 r10187 - trunk/gsa mailing-list