CVE-2011-1364
Summary
| CVE | CVE-2011-1364 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-10-30 19:55:00 UTC |
| Updated | 2017-08-17 01:34:00 UTC |
| Description | Cross-site request forgery (CSRF) vulnerability in _ah/admin/interactive/execute (aka the Interactive Console) in the SDK Console (aka Admin Console) in the Google App Engine Python SDK before 1.5.4 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary Python code via the code parameter. |
Risk And Classification
Problem Types: CWE-352
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | App Engine Python Sdk | 1.0.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.0.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.4 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.5 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.6 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.7 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.8 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.9 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.4 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.5 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.6 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.7 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.4 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.5 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.6 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.7 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.8 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.5.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.5.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.5.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.0.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.0.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.4 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.5 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.6 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.7 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.8 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.9 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.4 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.5 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.6 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.7 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.4 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.5 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.6 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.7 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.8 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.5.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.5.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.5.2 | All | All | All | |
| Application | App Engine Python Sdk | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| SdkReleaseNotes - googleappengine - Google App Engine Python SDK Release Notes - Google App Engine - Google Project Hosting | MISC | code.google.com | Patch |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| Access denied | blog.watchfire.com used Cloudflare to restrict access | MISC | blog.watchfire.com | Exploit |
| Google App Engine SDK Cross Site Request Forgery Vulnerability And Command Execution Weaknesses | BID | www.securityfocus.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.