fkie_cve-2013-1088
Vulnerability from fkie_nvd
Published
2013-04-24 10:28
Modified
2025-04-11 00:51
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container.
References
cve@mitre.orghttp://www.novell.com/support/kb/doc.php?id=7010166Vendor Advisory
cve@mitre.orghttps://bugzilla.novell.com/show_bug.cgi?id=726260
af854a3a-2127-422b-91ae-364da2661108http://www.novell.com/support/kb/doc.php?id=7010166Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.novell.com/show_bug.cgi?id=726260
Impacted products
Vendor Product Version
novell imanager *
novell imanager 2.7
novell imanager 2.7
novell imanager 2.7
novell imanager 2.7
novell imanager 2.7
novell imanager 2.7
novell imanager 2.7
novell imanager 2.7
novell imanager 2.7.1
novell imanager 2.7.2
novell imanager 2.7.3
novell imanager 2.7.3
novell imanager 2.7.3
novell imanager 2.7.3
novell imanager 2.7.4
novell imanager 2.7.5


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:novell:imanager:*:sp6:*:*:*:*:*:*",
              "matchCriteriaId": "58461B54-58CA-4C0C-BE64-7D9F1012A33C",
              "versionEndIncluding": "2.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "B982AA70-B5BA-4E56-8DBE-15EEC0A70DA5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7:refresh6:*:*:*:*:*:*",
              "matchCriteriaId": "C8303A14-6DF5-4A65-A570-154A7A2FECDF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7:sp4:*:*:*:*:*:*",
              "matchCriteriaId": "C62EA146-9EFC-4CDC-96A7-E44CC0744B83",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7:sp4_patch1:*:*:*:*:*:*",
              "matchCriteriaId": "155397A8-932C-40EC-B763-AC39D5B8B736",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7:sp4_patch2:*:*:*:*:*:*",
              "matchCriteriaId": "7DBD982A-EF73-403E-B486-BBECBCE606BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7:sp4_patch3:*:*:*:*:*:*",
              "matchCriteriaId": "096ADACF-B48F-4636-B141-4D680F498A49",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7:sp4_patch4:*:*:*:*:*:*",
              "matchCriteriaId": "724BD98B-2407-4B8D-8892-A39B965249BC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7:sp5:*:*:*:*:*:*",
              "matchCriteriaId": "8F0B8EAE-210E-4AB8-9373-B8FC1216C056",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "87E03D12-D745-4071-A309-3E2DD2CC5BE7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0CBA9BF-C7F3-4CBB-92A8-DB554056ADD4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "50360B96-A5EB-48BE-A6B5-DE7D3ECA3CFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7.3:ftf2:*:*:*:*:*:*",
              "matchCriteriaId": "01F00C86-B0C3-4C7D-855F-466F63153712",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7.3:ftf4:*:*:*:*:*:*",
              "matchCriteriaId": "3B39D2B9-2F31-4930-B356-6F315CA34EED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7.3:sp3:*:*:*:*:*:*",
              "matchCriteriaId": "57C73F10-944E-4366-A02D-FC1AE155E073",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "867A2FDB-5C1A-4A09-8856-9F055BDE9F28",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:imanager:2.7.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "9DA65B98-93B7-4EBF-A630-DA67D71DEEA3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo cross-site request forgery (CSRF) en iManager de Novell versi\u00f3n 2.7 anterior a SP6 Parche 1, permite a los atacantes remotos secuestrar la autenticaci\u00f3n de usuarios arbitrarios mediante el aprovechamiento de la comprobaci\u00f3n incorrecta de peticiones para c\u00f3digo desplegado de iManager dentro de un contenedor Apache Tomcat."
    }
  ],
  "id": "CVE-2013-1088",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2013-04-24T10:28:37.790",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.novell.com/support/kb/doc.php?id=7010166"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.novell.com/show_bug.cgi?id=726260"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.novell.com/support/kb/doc.php?id=7010166"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.novell.com/show_bug.cgi?id=726260"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.