Cerberus FTP Server CVE-2012-2999 Cross Site Request Forgery Vulnerability

Bugtraq ID:	55788
Class:	Design Error
CVE:	CVE-2012-2999
Remote:	Yes
Local:	No
Published:	Oct 04 2012 12:00AM
Updated:	Oct 04 2012 03:00PM
Credit:	redro0cky from Beijing Leadsec Technology
Vulnerable:	Cerberus FTP Server 4.0.3 0 Cerberus FTP Server 4.0.2 2 Cerberus FTP Server 3.0.6 Cerberus FTP Server 3.0.3 Cerberus FTP Server 3.0.2 Cerberus FTP Server 3.0.1 Cerberus FTP Server 2.32 Cerberus FTP Server 2.11 BETA 2 Cerberus FTP Server 2.11 BETA Cerberus FTP Server 2.1 Cerberus FTP Server 1.71 Cerberus FTP Server 2.46 Cerberus FTP Server 2.45
Not Vulnerable:

Cerberus FTP Server CVE-2012-2999 Cross Site Request Forgery Vulnerability

Cerberus FTP Server is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

Versions prior to Cerberus FTP Server 5.0.5 are vulnerable.

Cerberus FTP Server CVE-2012-2999 Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim to open a malicious URI.

Cerberus FTP Server CVE-2012-2999 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the reference for more details.

Cerberus FTP Server CVE-2012-2999 Cross Site Request Forgery Vulnerability

References:

• Cerberus FTP Server Homepage (Cerberus)