CVE-2009-0037 : Detail

CVE-2009-0037

9.92%V4
2009-03-05
02h00 +00:00
Cross-Site Request Forgery - CSRF
A01-Broken Access Control
Network
2024-08-07
04h17 +00:00
Notifikasi untuk CVE tertentu
Tetap terinformasi tentang perubahan untuk CVE tertentu.
Kelola notifikasi

Deskripsi CVE

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.

Informasi CVE

Kelemahan Terkait

CWE-ID Nama Kelemahan Sumber
CWE-352 Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Metrik

Metrik Skor Tingkat keparahan CVSS Vektor Sumber
V2 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS adalah model penilaian yang memprediksi kemungkinan suatu kerentanan dieksploitasi.

Skor EPSS

Model EPSS menghasilkan skor probabilitas antara 0 dan 1 (0 hingga 100%). Semakin tinggi skor, semakin besar probabilitas bahwa suatu kerentanan akan dieksploitasi.

Persentil EPSS

Persentil digunakan untuk meranking CVE berdasarkan skor EPSS mereka. Misalnya, CVE di persentil ke-95 berdasarkan skor EPSS-nya lebih mungkin dieksploitasi daripada 95% CVE lainnya. Dengan demikian, persentil digunakan untuk membandingkan skor EPSS suatu CVE dengan CVE lainnya.

Informasi eksploitasi

Exploit Database EDB-ID : 32834

Tanggal publikasi : 2009-03-02 23h00 +00:00
Penulis : David Kierznowski
Terverifikasi EDB : Yes

Produk yang Disebutkan

Konfigurasi 0

Curl>>Curl >> Version 5.11

Curl>>Curl >> Version 6.0

Curl>>Curl >> Version 6.1beta

Curl>>Curl >> Version 6.2

Curl>>Curl >> Version 6.3

Curl>>Curl >> Version 6.3.1

Curl>>Curl >> Version 6.4

Curl>>Curl >> Version 6.5

Curl>>Curl >> Version 6.5.1

Curl>>Curl >> Version 6.5.2

Curl>>Curl >> Version 7.1

Curl>>Curl >> Version 7.1.1

Curl>>Curl >> Version 7.2

Curl>>Curl >> Version 7.2.1

Curl>>Curl >> Version 7.3

Curl>>Curl >> Version 7.4

Curl>>Curl >> Version 7.4.1

Curl>>Curl >> Version 7.4.2

Curl>>Curl >> Version 7.5

Curl>>Curl >> Version 7.5.1

Curl>>Curl >> Version 7.5.2

Curl>>Curl >> Version 7.6

Curl>>Curl >> Version 7.6.1

Curl>>Curl >> Version 7.7

Curl>>Curl >> Version 7.7.1

Curl>>Curl >> Version 7.7.2

Curl>>Curl >> Version 7.7.3

Curl>>Curl >> Version 7.8

Curl>>Curl >> Version 7.8.1

Curl>>Curl >> Version 7.8.2

Curl>>Curl >> Version 7.9

Curl>>Curl >> Version 7.9.1

Curl>>Curl >> Version 7.9.2

Curl>>Curl >> Version 7.9.3

Curl>>Curl >> Version 7.9.4

Curl>>Curl >> Version 7.9.5

Curl>>Curl >> Version 7.9.6

Curl>>Curl >> Version 7.9.7

Curl>>Curl >> Version 7.9.8

Curl>>Curl >> Version 7.10

Curl>>Curl >> Version 7.10.1

Curl>>Curl >> Version 7.10.2

Curl>>Curl >> Version 7.10.3

Curl>>Curl >> Version 7.10.4

Curl>>Curl >> Version 7.10.5

Curl>>Curl >> Version 7.10.6

Curl>>Curl >> Version 7.10.7

Curl>>Curl >> Version 7.10.8

Curl>>Curl >> Version 7.11.1

Curl>>Curl >> Version 7.12

Curl>>Curl >> Version 7.12.1

Curl>>Curl >> Version 7.12.2

Curl>>Curl >> Version 7.13

Curl>>Curl >> Version 7.13.2

Curl>>Curl >> Version 7.14

Curl>>Curl >> Version 7.14.1

Curl>>Curl >> Version 7.15

Curl>>Curl >> Version 7.15.1

Curl>>Curl >> Version 7.15.3

Curl>>Curl >> Version 7.16.3

Curl>>Curl >> Version 7.16.4

Curl>>Curl >> Version 7.17

Curl>>Curl >> Version 7.18

Curl>>Curl >> Version 7.19.3

Curl>>Libcurl >> Version 5.11

Curl>>Libcurl >> Version 7.12

Curl>>Libcurl >> Version 7.12.1

Curl>>Libcurl >> Version 7.12.2

Curl>>Libcurl >> Version 7.12.3

Curl>>Libcurl >> Version 7.13

Curl>>Libcurl >> Version 7.13.1

Curl>>Libcurl >> Version 7.13.2

Curl>>Libcurl >> Version 7.14

Curl>>Libcurl >> Version 7.14.1

Curl>>Libcurl >> Version 7.15

Curl>>Libcurl >> Version 7.15.1

Curl>>Libcurl >> Version 7.15.2

Curl>>Libcurl >> Version 7.15.3

Curl>>Libcurl >> Version 7.16.3

Curl>>Libcurl >> Version 7.19.3

Referensi

http://www.ubuntu.com/usn/USN-726-1
Tags : vendor-advisory, x_refsource_UBUNTU
http://secunia.com/advisories/34259
Tags : third-party-advisory, x_refsource_SECUNIA
http://curl.haxx.se/lxr/source/CHANGES
Tags : x_refsource_CONFIRM
http://secunia.com/advisories/35766
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/34255
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.redhat.com/support/errata/RHSA-2009-0341.html
Tags : vendor-advisory, x_refsource_REDHAT
http://www.debian.org/security/2009/dsa-1738
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.vupen.com/english/advisories/2009/1865
Tags : vdb-entry, x_refsource_VUPEN
http://secunia.com/advisories/34138
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/34202
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.vupen.com/english/advisories/2009/0581
Tags : vdb-entry, x_refsource_VUPEN
http://www.securityfocus.com/bid/33962
Tags : vdb-entry, x_refsource_BID
http://support.apple.com/kb/HT4077
Tags : x_refsource_CONFIRM
http://security.gentoo.org/glsa/glsa-200903-21.xml
Tags : vendor-advisory, x_refsource_GENTOO
http://www.securitytracker.com/id?1021783
Tags : vdb-entry, x_refsource_SECTRACK
http://secunia.com/advisories/34251
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/34399
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/34237
Tags : third-party-advisory, x_refsource_SECUNIA