Bug 284356 – <=www-apps/twiki-4.3.2: Multiple vulnerabilites (CVE-2009-4898)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Samuel Tardieu 2009-09-09 21:11:52 UTC]

The TWiki SecurityTeam triaged this issue as documented in TWikiSecurityAlertProcess and assigned the following severity level:

    * Severity 3 issue: TWiki content or browser is compromised. 

Reproducible: Always

Steps to Reproduce:




This is fixed in TWiki 4.3.2.

[Comment 1 Stefan Behte (RETIRED) 2010-09-24 20:28:30 UTC]

CVE-2009-4898 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4898):
  Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.2
  allows remote attackers to hijack the authentication of arbitrary
  users for requests that update pages, as demonstrated by a URL for a
  save script in the ACTION attribute of a FORM element, in conjunction
  with a call to the submit method in the onload attribute of a BODY
  element.  NOTE: this issue exists because of an insufficient fix for
  CVE-2009-1339.

[Comment 2 Markos Chandras (RETIRED) 2012-03-03 18:47:07 UTC]

package has been removed from tree

[Comment 3 Tim Sammut (RETIRED) 2012-03-03 20:16:39 UTC]

(In reply to comment #2)
> package has been removed from tree

Thanks. Closing noglsa since twiki was only ever ~arch.