MySQL Enterprise Monitor Multiple Unspecified Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	40537
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 26 2010 12:00AM
Updated:	May 26 2010 12:00AM
Credit:	The vendor reported these issues.
Vulnerable:	MySQL AB MySQL Enterprise Monitor 2.1.1
Not Vulnerable:	MySQL AB MySQL Enterprise Monitor 2.1.2

MySQL Enterprise Monitor Multiple Unspecified Cross Site Request Forgery Vulnerabilities

MySQL Enterprise Monitor is prone to multiple cross-site request-forgery vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; other attacks are also possible.

Versions prior to MySQL Enterprise Monitor 2.1.2 are vulnerable.

MySQL Enterprise Monitor Multiple Unspecified Cross Site Request Forgery Vulnerabilities

To exploit these issues, an attacker must entice a user into visiting a malicious site.

MySQL Enterprise Monitor Multiple Unspecified Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

MySQL Enterprise Monitor Multiple Unspecified Cross Site Request Forgery Vulnerabilities

References:

• C.2.1. Changes in MySQL Enterprise Monitor 2.1.2 (26 May 2010) (MySQL AB)
  
• MySQL Enterprise Monitor (MySQL AB)