{"api_version":"1","generated_at":"2026-07-23T11:32:13+00:00","cve":"CVE-2009-1733","urls":{"html":"https://cve.report/CVE-2009-1733","api":"https://cve.report/api/cve/CVE-2009-1733.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-1733","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-1733"},"summary":{"title":"CVE-2009-1733","description":"Cross-site request forgery (CSRF) vulnerability in IPplan 4.91a allows remote attackers to hijack the authentication of administrators for requests that (1) change the password, (2) add users, or (3) delete users via unknown vectors.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-05-20 19:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-352","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://secunia.com/advisories/34985","name":"http://secunia.com/advisories/34985","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"IPplan Cross-Site Scripting and Cross-Site Request Forgery - Advisories - Community","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://holisticinfosec.org/content/view/113/45/","name":"http://holisticinfosec.org/content/view/113/45/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"holisticinfosec.org - HIO-2009-0417 IPPlan 4.91 Multiple Vulnerabilities","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50632","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50632","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/54601","name":"http://osvdb.org/54601","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1733","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1733","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"1733","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"richard_ellerbrock","cpe5":"ipplan","cpe6":"4.91a","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T05:20:35.203Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"54601","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/54601"},{"name":"34985","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/34985"},{"name":"ipplan-unspecified-csrf(50632)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50632"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://holisticinfosec.org/content/view/113/45/"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-05-20T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site request forgery (CSRF) vulnerability in IPplan 4.91a allows remote attackers to hijack the authentication of administrators for requests that (1) change the password, (2) add users, or (3) delete users via unknown vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-16T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"54601","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/54601"},{"name":"34985","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/34985"},{"name":"ipplan-unspecified-csrf(50632)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50632"},{"tags":["x_refsource_MISC"],"url":"http://holisticinfosec.org/content/view/113/45/"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-1733","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site request forgery (CSRF) vulnerability in IPplan 4.91a allows remote attackers to hijack the authentication of administrators for requests that (1) change the password, (2) add users, or (3) delete users via unknown vectors."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"54601","refsource":"OSVDB","url":"http://osvdb.org/54601"},{"name":"34985","refsource":"SECUNIA","url":"http://secunia.com/advisories/34985"},{"name":"ipplan-unspecified-csrf(50632)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50632"},{"name":"http://holisticinfosec.org/content/view/113/45/","refsource":"MISC","url":"http://holisticinfosec.org/content/view/113/45/"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-1733","datePublished":"2009-05-20T19:00:00.000Z","dateReserved":"2009-05-20T00:00:00.000Z","dateUpdated":"2024-08-07T05:20:35.203Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-05-20 19:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-352","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:richard_ellerbrock:ipplan:4.91a:*:*:*:*:*:*:*","matchCriteriaId":"14228614-7FE5-402B-8A02-BB2AFD2996B6"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"1733","Ordinal":"1","Title":"CVE-2009-1733","CVE":"CVE-2009-1733","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"1733","Ordinal":"1","NoteData":"Cross-site request forgery (CSRF) vulnerability in IPplan 4.91a allows remote attackers to hijack the authentication of administrators for requests that (1) change the password, (2) add users, or (3) delete users via unknown vectors.","Type":"Description","Title":"CVE-2009-1733"},{"CveYear":"2009","CveId":"1733","Ordinal":"2","NoteData":"2009-05-20","Type":"Other","Title":"Published"},{"CveYear":"2009","CveId":"1733","Ordinal":"3","NoteData":"2017-08-16","Type":"Other","Title":"Modified"}]}}}