CVE-2008-7139

Eye-Fi Manager 1.1.2 - Cross-Site Request Forgery via SOAPAction Parameter

Title source: llm
STIX 2.1

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in WS-Proxy in Eye-Fi 1.1.2 allow remote attackers to hijack the authentication of users for requests that modify configuration via a SOAPAction parameter of (1) urn:SetOptions for autostart, (2) urn:SetDesktopSync for file upload, or (3) urn:SetFolderConfig for file download location or modification of authentication credentials; and (4) urn:AddNetwork for adding an arbitrary Service Set Identifier (SSID) to hijack the image upload.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/28085
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/489045/100/0/threaded
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29221
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/40995
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/42718

Scores

EPSS 0.0073
EPSS Percentile 49.8%

Details

CWE
CWE-352
Status published
Products (1)
eye.fi/eye-fi_manager 1.1.2
Published Sep 01, 2009
Tracked Since Feb 18, 2026