Information ================================= Name: CSRF Vulnerability in TestLink 1.9.14 Affected Software: TestLink Affected Versions: 1.9.14 and possibly below Vendor Homepage: http://testlink.org/ Severity: High Status: Fixed Vulnerability Type: ================================= Cross Site Request Forgery (CSRF) CVE Reference: ================================= Not assigned Technical Details: ================================= Even though the use of CSRF tokens are being implemented in the application, they aren't properly validated at the server side. This allows malicious requests to be generated by the attacker and get them processed by the server on behalf of the victim. By exploiting the vulnerability, the attacker will be able to create user accounts with administrator privileges on the application. Exploit Code =================================
Exploitation Technique: =================================== Remote Severity Level: =================================== High Advisory Timeline =================================== Sat, 7 Nov 2015 13:14:33 +0530 - First Contact Sat, 7 Nov 2015 08:52:14 +0100 - Vendor Response Sat, 7 Nov 2015 13:00:54 +0100 - Vendor Fixed Sun, 8 Nov 2015 19:03:00 +0530 - Public Disclosure Solution ==================================== This vulnerability is fixed in TestLink 1.9.15 (Tauriel) Fix: http://ift.tt/1Qfj9ty Credits & Authors ==================================== Aravind C Ajayan, Balagopal N
Source: Gmail -> IFTTT-> Blogger
No comments:
Post a Comment