CVE-2013-7107: CSRF
First published: Wed Jan 15 2014(Updated: )
Cross-site request forgery (CSRF) vulnerability in cmd.cgi in Icinga 1.8.5, 1.9.4, 1.10.2, and earlier allows remote attackers to hijack the authentication of users for unspecified commands via unspecified vectors, as demonstrated by bypassing authentication requirements for CVE-2013-7106.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Icinga Icinga Web 2 | <=1.10.2 | |
| Icinga Icinga Web 2 | =0.8.0 | |
| Icinga Icinga Web 2 | =0.8.1 | |
| Icinga Icinga Web 2 | =0.8.2 | |
| Icinga Icinga Web 2 | =0.8.3 | |
| Icinga Icinga Web 2 | =0.8.4 | |
| Icinga Icinga Web 2 | =1.0 | |
| Icinga Icinga Web 2 | =1.0-rc1 | |
| Icinga Icinga Web 2 | =1.0.1 | |
| Icinga Icinga Web 2 | =1.0.2 | |
| Icinga Icinga Web 2 | =1.0.3 | |
| Icinga Icinga Web 2 | =1.2.0 | |
| Icinga Icinga Web 2 | =1.2.1 | |
| Icinga Icinga Web 2 | =1.3.0 | |
| Icinga Icinga Web 2 | =1.3.1 | |
| Icinga Icinga Web 2 | =1.4.0 | |
| Icinga Icinga Web 2 | =1.4.1 | |
| Icinga Icinga Web 2 | =1.6.0 | |
| Icinga Icinga Web 2 | =1.6.1 | |
| Icinga Icinga Web 2 | =1.6.2 | |
| Icinga Icinga Web 2 | =1.7.0 | |
| Icinga Icinga Web 2 | =1.7.1 | |
| Icinga Icinga Web 2 | =1.7.2 | |
| Icinga Icinga Web 2 | =1.7.3 | |
| Icinga Icinga Web 2 | =1.7.4 | |
| Icinga Icinga Web 2 | =1.8.0 | |
| Icinga Icinga Web 2 | =1.8.1 | |
| Icinga Icinga Web 2 | =1.8.2 | |
| Icinga Icinga Web 2 | =1.8.3 | |
| Icinga Icinga Web 2 | =1.8.4 | |
| Icinga Icinga Web 2 | =1.8.5 | |
| Icinga Icinga Web 2 | =1.9.0 | |
| Icinga Icinga Web 2 | =1.9.1 | |
| Icinga Icinga Web 2 | =1.9.2 | |
| Icinga Icinga Web 2 | =1.9.3 | |
| Icinga Icinga Web 2 | =1.9.4 | |
| Icinga Icinga Web 2 | =1.10.0 | |
| Icinga Icinga Web 2 | =1.10.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-7107?
CVE-2013-7107 is classified as a medium severity vulnerability that allows cross-site request forgery (CSRF).
How do I fix CVE-2013-7107?
To fix CVE-2013-7107, users should upgrade Icinga to version 1.10.3 or later, which addresses this CSRF vulnerability.
What versions of Icinga are affected by CVE-2013-7107?
CVE-2013-7107 affects Icinga versions 0.8.0 to 1.10.2 inclusive.
Can CVE-2013-7107 lead to authentication hijacking?
Yes, CVE-2013-7107 can allow remote attackers to hijack user authentication for unspecified commands.
What type of attack does CVE-2013-7107 involve?
CVE-2013-7107 involves a cross-site request forgery (CSRF) attack due to insufficient verification of user requests.
- agent/severity
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/event
- agent/references
- agent/author
- agent/description
- vendor/icinga
- canonical/icinga icinga web 2
- version/icinga icinga web 2/1.10.2
- version/icinga icinga web 2/0.8.0
- version/icinga icinga web 2/0.8.1
- version/icinga icinga web 2/0.8.2
- version/icinga icinga web 2/0.8.3
- version/icinga icinga web 2/0.8.4
- version/icinga icinga web 2/1.0
- version/icinga icinga web 2/1.0-rc1
- version/icinga icinga web 2/1.0.1
- version/icinga icinga web 2/1.0.2
- version/icinga icinga web 2/1.0.3
- version/icinga icinga web 2/1.2.0
- version/icinga icinga web 2/1.2.1
- version/icinga icinga web 2/1.3.0
- version/icinga icinga web 2/1.3.1
- version/icinga icinga web 2/1.4.0
- version/icinga icinga web 2/1.4.1
- version/icinga icinga web 2/1.6.0
- version/icinga icinga web 2/1.6.1
- version/icinga icinga web 2/1.6.2
- version/icinga icinga web 2/1.7.0
- version/icinga icinga web 2/1.7.1
- version/icinga icinga web 2/1.7.2
- version/icinga icinga web 2/1.7.3
- version/icinga icinga web 2/1.7.4
- version/icinga icinga web 2/1.8.0
- version/icinga icinga web 2/1.8.1
- version/icinga icinga web 2/1.8.2
- version/icinga icinga web 2/1.8.3
- version/icinga icinga web 2/1.8.4
- version/icinga icinga web 2/1.8.5
- version/icinga icinga web 2/1.9.0
- version/icinga icinga web 2/1.9.1
- version/icinga icinga web 2/1.9.2
- version/icinga icinga web 2/1.9.3
- version/icinga icinga web 2/1.9.4
- version/icinga icinga web 2/1.10.0
- version/icinga icinga web 2/1.10.1