CVE-2009-4898

Published: Sep 7, 2010Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.2 allows remote attackers to hijack the authentication of arbitrary users for requests that update pages, as demonstrated by a URL for a save script in the ACTION attribute of a FORM element, in conjunction with a call to the submit method in the onload attribute of a BODY element. NOTE: this issue exists because of an insufficient fix for CVE-2009-1339.

Affected (16)

Products: Twiki: Twiki

Twiki

1 product

Twiki

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Twiki Twiki	Up to 4.3.1
Twiki Twiki	Version 4.0.0
Twiki Twiki	Version 4.0.1
Twiki Twiki	Version 4.0.2
Twiki Twiki	Version 4.0.3
Twiki Twiki	Version 4.0.4
Twiki Twiki	Version 4.0.5
Twiki Twiki	Version 4.1.0
Twiki Twiki	Version 4.1.1
Twiki Twiki	Version 4.1.2
Twiki Twiki	Version 4.2.0
Twiki Twiki	Version 4.2.1
Twiki Twiki	Version 4.2.2
Twiki Twiki	Version 4.2.3
Twiki Twiki	Version 4.2.4
Twiki Twiki	Version 4.3.0