Unscored CVE-2009-3580 EUVD-2009-3561GHSA-mfmx-3jxx-p7cq

Cross-site request forgery (CSRF) vulnerability in am.pl in SQL-Ledger 2.8.24 allows remote attackers to hijack the authentication of arbit…

Published Dec 23, 2009 · Updated Aug 7, 2024 · Assigned by mitre

Package: sql-ledger Package: sql-ledger Ecosystem: Debian Ecosystem: Ubuntu

Description

Cross-site request forgery (CSRF) vulnerability in am.pl in SQL-Ledger 2.8.24 allows remote attackers to hijack the authentication of arbitrary users for requests that change a password via the login, new_password, and confirm_password parameters in a preferences action.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	sql-ledger	No fix yet	—
Debian 13	sql-ledger	No fix yet	—
Debian 12	sql-ledger	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	sql-ledger	No fix yet	—

References

sqlledger-am-csrf(54964) vdb-entry
20091221 SQL-Ledger â?? several vulnerabilities mailing-list
37877 third-party-advisory