CVE-2011-2191: XSS

Q: What is the severity of CVE-2011-2191?

CVE-2011-2191 is classified as a medium severity cross-site request forgery (CSRF) vulnerability.

Q: How do I fix CVE-2011-2191?

To mitigate CVE-2011-2191, upgrade Cherokee to version 1.2.99 or later.

Q: What does CVE-2011-2191 exploit?

CVE-2011-2191 exploits a CSRF vulnerability in Cherokee-admin, allowing attackers to hijack administrator authentication.

Q: Which versions of Cherokee are affected by CVE-2011-2191?

CVE-2011-2191 affects Cherokee versions prior to 1.2.99.

Q: What are the potential impacts of CVE-2011-2191?

Exploitation of CVE-2011-2191 can lead to unauthorized actions being performed on behalf of an authenticated administrator.

Published Jun 14, 2011

Updated

Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee before 1.2.99 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences, as demonstrated by a crafted nickname field to vserver/apply.

Other sources

Two flaws were reported in Cherokee.

The first (CVE-2011-2191) is that the Cherokee server admin configuration web interface is vulnerable to CSRF. If an admin is logged into the Cherokee admin interface and visits a site which runs a malicious script, Cherokee can be reconfigured to execute arbitrary commands [1]. It is also vulnerable to use the CSRF to produce a persistant XSS [2].

The second (CVE-2011-2090) is that Cherokee seeds srand with a combination of the time and the PID of the admin process, after which rand() is called to generate a random password -- this is unsafe and allows for fairly easy local password guessing by a local user [3].

[1] http://seclists.org/fulldisclosure/2011/Jun/0 [2] http://www.openwall.com/lists/oss-security/2011/06/03/6 [3] http://code.google.com/p/cherokee/issues/detail?id=1212

— Red Hat

Affected Software

137 affected components

Cherokee-project Cherokee<=1.2.98

Cherokee-project Cherokee=0.3.0

Cherokee-project Cherokee=0.4.0

Cherokee-project Cherokee=0.4.1

Cherokee-project Cherokee=0.4.2

Cherokee-project Cherokee=0.4.3

Cherokee-project Cherokee=0.4.4

Cherokee-project Cherokee=0.4.5

Cherokee-project Cherokee=0.4.6

Cherokee-project Cherokee=0.4.7

Cherokee-project Cherokee=0.4.8

Cherokee-project Cherokee=0.4.9

Cherokee-project Cherokee=0.4.10

Cherokee-project Cherokee=0.4.11

Cherokee-project Cherokee=0.4.12

Cherokee-project Cherokee=0.4.13

Cherokee-project Cherokee=0.4.14

Cherokee-project Cherokee=0.4.15

Cherokee-project Cherokee=0.4.16

Cherokee-project Cherokee=0.4.17

Cherokee-project Cherokee=0.4.18

Cherokee-project Cherokee=0.4.19

Cherokee-project Cherokee=0.4.20

Cherokee-project Cherokee=0.4.21

Cherokee-project Cherokee=0.4.22

Cherokee-project Cherokee=0.4.23

Cherokee-project Cherokee=0.4.24

Cherokee-project Cherokee=0.4.25

Cherokee-project Cherokee=0.4.26

Cherokee-project Cherokee=0.4.27

Cherokee-project Cherokee=0.4.28

Cherokee-project Cherokee=0.4.29

Cherokee-project Cherokee=0.4.30

Cherokee-project Cherokee=0.5.0

Cherokee-project Cherokee=0.5.1

Cherokee-project Cherokee=0.5.2

Cherokee-project Cherokee=0.5.3

Cherokee-project Cherokee=0.5.4

Cherokee-project Cherokee=0.5.5

Cherokee-project Cherokee=0.5.6

Cherokee-project Cherokee=0.6.0

Cherokee-project Cherokee=0.6.1

Cherokee-project Cherokee=0.7.0

Cherokee-project Cherokee=0.7.1

Cherokee-project Cherokee=0.7.2

Cherokee-project Cherokee=0.8.0

Cherokee-project Cherokee=0.8.1

Cherokee-project Cherokee=0.9.0

Cherokee-project Cherokee=0.9.1

Cherokee-project Cherokee=0.9.2

Cherokee-project Cherokee=0.9.3

Cherokee-project Cherokee=0.9.4

Cherokee-project Cherokee=0.10.0

Cherokee-project Cherokee=0.10.1

Cherokee-project Cherokee=0.11.0

Cherokee-project Cherokee=0.11.1

Cherokee-project Cherokee=0.11.2

Cherokee-project Cherokee=0.11.3

Cherokee-project Cherokee=0.11.4

Cherokee-project Cherokee=0.11.5

Cherokee-project Cherokee=0.11.6

Cherokee-project Cherokee=0.98.0

Cherokee-project Cherokee=0.98.1

Cherokee-project Cherokee=0.99.0

Cherokee-project Cherokee=0.99.1

Cherokee-project Cherokee=0.99.2

Cherokee-project Cherokee=0.99.3

Cherokee-project Cherokee=0.99.4

Cherokee-project Cherokee=0.99.5

Cherokee-project Cherokee=0.99.6

Cherokee-project Cherokee=0.99.07

Cherokee-project Cherokee=0.99.8

Cherokee-project Cherokee=0.99.9

Cherokee-project Cherokee=0.99.10

Cherokee-project Cherokee=0.99.11

Cherokee-project Cherokee=0.99.12

Cherokee-project Cherokee=0.99.13

Cherokee-project Cherokee=0.99.14

Cherokee-project Cherokee=0.99.15

Cherokee-project Cherokee=0.99.16

Cherokee-project Cherokee=0.99.17

Cherokee-project Cherokee=0.99.18

Cherokee-project Cherokee=0.99.19

Cherokee-project Cherokee=0.99.20

Cherokee-project Cherokee=0.99.21

Cherokee-project Cherokee=0.99.22

Cherokee-project Cherokee=0.99.23

Cherokee-project Cherokee=0.99.24

Cherokee-project Cherokee=0.99.25

Cherokee-project Cherokee=0.99.26

Cherokee-project Cherokee=0.99.27

Cherokee-project Cherokee=0.99.28

Cherokee-project Cherokee=0.99.29

Cherokee-project Cherokee=0.99.30

Cherokee-project Cherokee=0.99.31

Cherokee-project Cherokee=0.99.32

Cherokee-project Cherokee=0.99.33

Cherokee-project Cherokee=0.99.34

Cherokee-project Cherokee=0.99.35

Cherokee-project Cherokee=0.99.36

Cherokee-project Cherokee=0.99.37

Cherokee-project Cherokee=0.99.38

Cherokee-project Cherokee=0.99.39

Cherokee-project Cherokee=0.99.40

Cherokee-project Cherokee=0.99.41

Cherokee-project Cherokee=0.99.42

Cherokee-project Cherokee=0.99.43

Cherokee-project Cherokee=0.99.44

Cherokee-project Cherokee=0.99.45

Cherokee-project Cherokee=0.99.46

Cherokee-project Cherokee=0.99.47

Cherokee-project Cherokee=0.99.48

Cherokee-project Cherokee=0.99.49

Cherokee-project Cherokee=1.0.0

Cherokee-project Cherokee=1.0.1

Cherokee-project Cherokee=1.0.2

Cherokee-project Cherokee=1.0.3

Cherokee-project Cherokee=1.0.4

Cherokee-project Cherokee=1.0.5

Cherokee-project Cherokee=1.0.6

Cherokee-project Cherokee=1.0.7

Cherokee-project Cherokee=1.0.8

Cherokee-project Cherokee=1.0.9

Cherokee-project Cherokee=1.0.10

Cherokee-project Cherokee=1.0.11

Cherokee-project Cherokee=1.0.12

Cherokee-project Cherokee=1.0.13

Cherokee-project Cherokee=1.0.14

Cherokee-project Cherokee=1.0.15

Cherokee-project Cherokee=1.0.16

Cherokee-project Cherokee=1.0.17

Cherokee-project Cherokee=1.0.18

Cherokee-project Cherokee=1.0.19

Cherokee-project Cherokee=1.0.20

Cherokee-project Cherokee=1.2.0

Cherokee-project Cherokee=1.2.1

Cherokee-project Cherokee=1.2.2

Remediation

Patch Available

http://www.cherokee-project.com/download/LATEST_is_1.2.99/cherokee-1.2.99.tar.gz

Patch Available

https://bugzilla.redhat.com/show_bug.cgi?id=713304

Event History

Jun 14, 2011

Data Sourced

10:25 PM

DescriptionSeverityAffected Software

Oct 7, 2011

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2011-2191?

CVE-2011-2191 is classified as a medium severity cross-site request forgery (CSRF) vulnerability.

How do I fix CVE-2011-2191?

To mitigate CVE-2011-2191, upgrade Cherokee to version 1.2.99 or later.

What does CVE-2011-2191 exploit?

CVE-2011-2191 exploits a CSRF vulnerability in Cherokee-admin, allowing attackers to hijack administrator authentication.

Which versions of Cherokee are affected by CVE-2011-2191?

CVE-2011-2191 affects Cherokee versions prior to 1.2.99.

What are the potential impacts of CVE-2011-2191?

Exploitation of CVE-2011-2191 can lead to unauthorized actions being performed on behalf of an authenticated administrator.

CVE-2011-2191: XSS

Other sources

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2011-2191?

How do I fix CVE-2011-2191?

What does CVE-2011-2191 exploit?

Which versions of Cherokee are affected by CVE-2011-2191?

What are the potential impacts of CVE-2011-2191?

Company

Resources

Contact