CVE-2015-4119: SQL Injection
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administrators for requests that create an administrator account via a request to admin/usersedit.php or (2) arbitrary users for requests that conduct SQL injection attacks via the server parameter to monitor/showsysstate.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4119?
The severity of CVE-2015-4119 is classified as medium due to the potential for cross-site request forgery (CSRF) attacks affecting user accounts.
How do I fix CVE-2015-4119?
To fix CVE-2015-4119, upgrade ISPConfig to version 3.0.5.4p7 or later, where the vulnerabilities have been addressed.
Who is affected by CVE-2015-4119?
CVE-2015-4119 affects ISPConfig versions prior to 3.0.5.4p7, particularly impacting administrators and users during CSRF attacks.
What types of attacks does CVE-2015-4119 enable?
CVE-2015-4119 enables cross-site request forgery (CSRF) attacks that can compromise administrator accounts and potentially hijack user sessions.
Is CVE-2015-4119 still a threat if I am using a patched version of ISPConfig?
If you are using a patched version of ISPConfig, CVE-2015-4119 is not a threat, as the vulnerabilities have been mitigated.