CVE-2009-1802: CSRF

Published May 28, 2009

Updated

Multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the authentication of admins for requests that create a new admin account or have unspecified other impact.

Affected Software

14 affected components

FreePBX FreePBX=2.4

FreePBX FreePBX=2.4.0_beta1

FreePBX FreePBX=2.4.0_beta2

FreePBX FreePBX=2.4.1

FreePBX FreePBX=2.5

FreePBX FreePBX=2.5.0_beta1

FreePBX FreePBX=2.5.0rc2

FreePBX FreePBX=2.5.0rc3

FreePBX FreePBX=2.5.1

FreePBX FreePBX=2.5.2

FreePBX=2.4.0

FreePBX=2.5.0

Sangoma FreePBX=2.4.0

Sangoma FreePBX=2.5.0

Remediation

Patch Available

http://www.securityfocus.com/bid/34857

Event History

May 28, 2009

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-1802?

CVE-2009-1802 is a high-severity vulnerability due to its potential to allow unauthorized account creation and administrative actions.

How do I fix CVE-2009-1802?

To fix CVE-2009-1802, it is recommended to upgrade to the latest version of FreePBX that addresses these CSRF vulnerabilities.

What are the affected versions for CVE-2009-1802?

CVE-2009-1802 affects FreePBX versions 2.4.x, 2.5.x, and 2.5.1, along with certain pre-release versions.

What type of attack does CVE-2009-1802 facilitate?

CVE-2009-1802 facilitates cross-site request forgery (CSRF) attacks that can hijack an admin's authentication.

Who is at risk from CVE-2009-1802?

Administrators using the vulnerable versions of FreePBX are at risk from CVE-2009-1802 due to the potential for unauthorized account manipulation.