Unscored CVE-2011-0650 EUVD-2011-0668GHSA-6pf5-h6gw-hqjw

Cross-site request forgery (CSRF) vulnerability in Greenbone Security Assistant (GSA) before 2.0+rc3 allows remote attackers to hijack the …

Published Jan 28, 2011 · Updated Aug 6, 2024 · Assigned by mitre

Description

Cross-site request forgery (CSRF) vulnerability in Greenbone Security Assistant (GSA) before 2.0+rc3 allows remote attackers to hijack the authentication of users for requests that send email via an OMP request to OpenVAS Manager. NOTE: this issue can be leveraged to bypass authentication requirements for exploiting CVE-2011-0018.

References

20110125 [OVSA20110118] OpenVAS Manager Vulnerable To Command Injection mailing-list
43092 third-party-advisory
http://www.openvas.org/OVSA20110118.html
greenbone-unspecifed-csrf(65012) vdb-entry
[openvas-commits] 20110203 r10151 - in trunk/gsa: . src src/html mailing-list
[openvas-commits] 20110203 r10187 - trunk/gsa mailing-list