CVE-2008-5115: CSRF

Published Nov 18, 2008

Updated

Cross-site request forgery (CSRF) vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to hijack the authentication of administrators for requests that update the password via idm/admin/changeself.jsp.

Affected Software

7 affected components

Sun Java System Identity Manager=6.0-sp2

Sun Java System Identity Manager=7.0

Sun Java System Identity Manager=6.0-sp1

Sun Java System Identity Manager=7.1

Sun Java System Identity Manager=6.0-sp3

Sun Java System Identity Manager=6.0-sp4

Sun Java System Identity Manager=6.0

Remediation

Patch Available

http://sunsolve.sun.com/search/document.do?assetkey=1-26-243386-1

Event History

Nov 18, 2008

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-5115?

CVE-2008-5115 is considered a high severity vulnerability due to its potential for cross-site request forgery against administrative functions.

How do I fix CVE-2008-5115?

To fix CVE-2008-5115, ensure that you apply the latest security patches released for Sun Java System Identity Manager.

Who is affected by CVE-2008-5115?

CVE-2008-5115 affects users of Sun Java System Identity Manager versions 6.0 up to SP4, 7.0, and 7.1.

What type of attack does CVE-2008-5115 permit?

CVE-2008-5115 permits remote attackers to hijack the authentication of administrators through cross-site request forgery.

What components are involved in CVE-2008-5115?

CVE-2008-5115 specifically involves the 'idm/admin/changeself.jsp' component of Sun Java System Identity Manager.