medium6.8Public exploit code
CVE-2010-3271
Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- IBM Websphere Application Server 7.0.0.13 - Cross-Site Request Forgery2011-06-15 · webapps · multiple · Verified
Impact
Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ibm | Websphere Application Server | through 7.0.0.13 Versions 2.0, 3.0, 3.0.2, 3.0.2.1, 3.0.2.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://securityreason.com/securityalert/8281
- http://www.coresecurity.com/content/IBM-WebSphere-CSRF
- http://www.exploit-db.com/exploits/17404
- http://www.securityfocus.com/archive/1/518465/100/0/threaded
- http://www.securityfocus.com/bid/48305
- http://securityreason.com/securityalert/8281
- http://www.coresecurity.com/content/IBM-WebSphere-CSRF
- http://www.exploit-db.com/exploits/17404
- http://www.securityfocus.com/archive/1/518465/100/0/threaded
- http://www.securityfocus.com/bid/48305