Description
Cross-site request forgery (CSRF) vulnerability in Foswiki before 1.0.5 allows remote attackers to hijack the authentication of arbitrary users for requests that modify pages, change permissions, or change group memberships, as demonstrated by a URL for a (1) save or (2) view script in the SRC attribute of an IMG element, a related issue to CVE-2009-1339.
References (6)
Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/50256
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/54148
Patch mailing-list
x_refsource_mlist
http://sourceforge.net/mailarchive/forum.php?thread_name=49F61C4E.2040806%40lavrsen.dk&forum_name=foswiki-announce
Patch, Vendor Advisory x_refsource_confirm
http://foswiki.org/Support/SecurityAlert-CVE-2009-1434
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/34863
Various Sources x_refsource_confirm
https://launchpad.net/bugs/cve/2009-1434
Scores
EPSS
0.0067
EPSS Percentile
47.7%
Details
CWE
CWE-352
Status
published
Products (5)
foswiki/foswiki
1.0.0
foswiki/foswiki
1.0.1
foswiki/foswiki
1.0.2
foswiki/foswiki
1.0.3
foswiki/foswiki
< 1.0.4
Published
Apr 30, 2009
Tracked Since
Feb 18, 2026