Description
Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee before 1.2.99 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences, as demonstrated by a crafted nickname field to vserver/apply.
References
- 49772 vdb-entry
- 20110601 cherokee server admin vulnerable to csrf mailing-list
- [oss-security] 20110606 Re: Security issue in cherokee mailing-list
- FEDORA-2011-12698 vendor-advisory
- https://launchpad.net/bugs/784632
- [oss-security] 20110602 CVE Request -- Cherokee -- server admin vulnerable to csrf mailing-list
- http://www.cherokee-project.com/download/LATEST_is_1.2.99/cherokee-1.2.99.tar.gz
- https://bugzilla.redhat.com/show_bug.cgi?id=713304
- [oss-security] 20110603 Security issue in cherokee mailing-list
- 72693 vdb-entry