CVE-2007-3489: CSRF
Cross-site request forgery (CSRF) vulnerability in pop/WizU.html in the management interface in Check Point VPN-1 Edge X Embedded NGX 7.0.33x on the Check Point VPN-1 UTM Edge allows remote attackers to perform privileged actions as administrators, as demonstrated by a request with the swuuser and swupass parameters, which adds an administrator account. NOTE: the CSRF attack has no timing window because there is no logout capability in the management interface.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3489?
CVE-2007-3489 is classified as a high severity vulnerability due to its potential to allow remote attackers to perform privileged actions.
How do I fix CVE-2007-3489?
To fix CVE-2007-3489, it's recommended to upgrade to a patched version of the Check Point VPN-1 UTM Edge software.
What systems are affected by CVE-2007-3489?
CVE-2007-3489 affects Check Point VPN-1 UTM Edge version 7.0.33.
What type of vulnerability is CVE-2007-3489?
CVE-2007-3489 is a cross-site request forgery (CSRF) vulnerability.
What actions can attackers perform due to CVE-2007-3489?
Attackers can execute privileged administrative actions through the management interface due to CVE-2007-3489.