#VU44865 Cross-site request forgery in Samba - CVE-2011-2522
Published: July 29, 2011 / Updated: April 29, 2021
Vulnerability identifier: #VU44865
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2011-2522
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
Samba
Samba
Software vendor:
Samba
Samba
Description
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
Remediation
Install update from vendor's website.
External links
- http://jvn.jp/en/jp/JVN29529126/index.html
- http://marc.info/?l=bugtraq&m=133527864025056&w=2
- http://osvdb.org/74071
- http://samba.org/samba/history/samba-3.5.10.html
- http://secunia.com/advisories/45393
- http://secunia.com/advisories/45488
- http://secunia.com/advisories/45496
- http://securityreason.com/securityalert/8317
- http://securitytracker.com/id?1025852
- http://ubuntu.com/usn/usn-1182-1
- http://www.debian.org/security/2011/dsa-2290
- http://www.exploit-db.com/exploits/17577
- http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:121
- http://www.samba.org/samba/security/CVE-2011-2522
- http://www.securityfocus.com/bid/48899
- https://bugzilla.redhat.com/show_bug.cgi?id=721348
- https://bugzilla.samba.org/show_bug.cgi?id=8290
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68843