Unscored severity · published Apr 30, 2009
CVE-2009-1434
Cross-site request forgery (CSRF) vulnerability in Foswiki before 1.0.5 allows remote attackers to hijack the authentication of arbitrary users for requests that modify pages,…
–
CVSS
0.7%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in Foswiki before 1.0.5 allows remote attackers to hijack the authentication of arbitrary users for requests that modify pages, change permissions, or change group memberships, as demonstrated by a URL for a (1) save or (2) view script in the SRC attribute of an IMG element, a related issue to CVE-2009-1339.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Foswiki · Foswiki
through 1.0.4; 1.0.0; 1.0.1; 1.0.2; 1.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1434
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1434
Patch
http://foswiki.org/Support/SecurityAlert-CVE-2009-1434
osvdb.org
http://osvdb.org/54148
Vendor Advisory
http://secunia.com/advisories/34863
Patch
http://sourceforge.net/mailarchive/forum.php?thread_name=49F61C4E.2040806%40lavrsen.dk&forum_name=foswiki-announce
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/50256
launchpad.net
https://launchpad.net/bugs/cve/2009-1434
More from Foswiki
9.8
CVE-2013-1666
Foswiki before 1.1.8 contains a code injection vulnerability in the MAKETEXT macro
7.5
CVE-2023-33756
An issue in the SpreadSheetPlugin component of Foswiki v2.1.7 and below allows attackers to execute a directory traversal
7.5
CVE-2023-24698
Insufficient parameter validation in the Foswiki::Sandbox component of Foswiki v2.1.7 and below allows attackers to perform a directory traversal via supplying a crafted web…
5.3
CVE-2026-2861
Foswiki Changes/Viewfile/Oops information disclosure
–
CVE-2012-6330
The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to cause a denial of service (memory…