Icinga CVE-2013-7107 Cross Site Request Forgery Vulnerability

Bugtraq ID:	64370
Class:	Design Error
CVE:	CVE-2013-7107
Remote:	Yes
Local:	No
Published:	Dec 02 2013 12:00AM
Updated:	Jun 11 2014 07:35PM
Credit:	DTAG Group Information Security
Vulnerable:	Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

Icinga CVE-2013-7107 Cross Site Request Forgery Vulnerability

Icinga iis prone to a cross-site request-forgery vulnerability because the application does not properly validate HTTP requests.



Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.



Icinga 1.10.2 is vulnerable. Other versions may also be affected.

Icinga CVE-2013-7107 Cross Site Request Forgery Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Icinga CVE-2013-7107 Cross Site Request Forgery Vulnerability

Solution:
Vendor patch is available. Please see the references for more information.

Icinga CVE-2013-7107 Cross Site Request Forgery Vulnerability

References:

• classic-ui: fix vulnerability against CSRF attacks CVE-2013-7107 #5346 (The Icinga Project)
  
• fix vulnerability against CSRF attacks CVE-2013-7107 (Icinga)
  
• Fwd: Vulnerability (Buffer Overflow) in Icinga 1.8, 1.9 and 1.10 (Icinga Issue # (SecLists.Org)
  
• icinga / icinga-core.git / shortlog (The Icinga Project)
  
• Icinga Homepage (Icinga)