CVE-2010-3449

Published: Dec 6, 2010Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1; and Apache Continuum 1.3.6, 1.4.0, and 1.1 through 1.2.3.1; allows remote attackers to hijack the authentication of administrators for requests that modify credentials.

Affected (28)

Products: Jesse Mcconnell: Redback · Apache: Archiva

Jesse Mcconnell

1 product

1 product

Configuration A

28 vulnerable

Vulnerable Software	Affected Versions
Jesse Mcconnell Redback	Up to 1.2.3
Jesse Mcconnell Redback	Version 1.0.1
Jesse Mcconnell Redback	Version 1.0.2
Jesse Mcconnell Redback	Version 1.0.3
Jesse Mcconnell Redback	Version 1.0
Jesse Mcconnell Redback	Version 1.0 alpha4
Jesse Mcconnell Redback	Version 1.1.1
Jesse Mcconnell Redback	Version 1.1.2
Jesse Mcconnell Redback	Version 1.1
Jesse Mcconnell Redback	Version 1.2.1
Jesse Mcconnell Redback	Version 1.2.2
Jesse Mcconnell Redback	Version 1.2
Jesse Mcconnell Redback	Version 1.2 beta1
Jesse Mcconnell Redback	Version 1.2 beta2
Apache Archiva	Version 1.0.1
Apache Archiva	Version 1.0.2
Apache Archiva	Version 1.0.3
Apache Archiva	Version 1.0
Apache Archiva	Version 1.1.1
Apache Archiva	Version 1.1.2
Apache Archiva	Version 1.1.3
Apache Archiva	Version 1.1.4
Apache Archiva	Version 1.1
Apache Archiva	Version 1.2.1
Apache Archiva	Version 1.2.2
Apache Archiva	Version 1.2
Apache Archiva	Version 1.3.1
Apache Archiva	Version 1.3

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (38)

http://archiva.apache.org/security.html

Source: secalert@redhat.com

http://continuum.apache.org/security.html

Source: secalert@redhat.com

http://jira.codehaus.org/browse/MRM-1438

Source: secalert@redhat.com

http://mail-archives.apache.org/mod_mbox/archiva-users/201011.mbox/ajax/%3CAANLkTimXejHAuXdoUKLN=GkNty1_XnRCbv0YA0T2cS_2%40mail.gmail.com%3E

Source: secalert@redhat.com

http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C032C189E-D821-4833-A8F2-F72365147695%40apache.org%3E

Source: secalert@redhat.com

http://seclists.org/fulldisclosure/2011/Feb/238

Source: secalert@redhat.com

http://secunia.com/advisories/42376

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/43261

Source: secalert@redhat.com

http://svn.apache.org/viewvc/archiva/branches/archiva-1.3.x/archiva-modules/archiva-web/archiva-webapp/src/main/resources/struts.xml?r1=1038518&r2=1038517&pathrev=1038518

Source: secalert@redhat.com

Patch

http://svn.apache.org/viewvc/archiva/branches/archiva-1.3.x/pom.xml?r1=1038518&r2=1038517&pathrev=1038518

Source: secalert@redhat.com

Patch

http://svn.apache.org/viewvc?view=revision&revision=1038518

Source: secalert@redhat.com

http://svn.apache.org/viewvc?view=revision&revision=1066010

Source: secalert@redhat.com

http://www.osvdb.org/69520

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/514937/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/516341/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/45095

Source: secalert@redhat.com

http://www.securitytracker.com/id?1025066

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/3098

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0373

Source: secalert@redhat.com

http://archiva.apache.org/security.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://continuum.apache.org/security.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://jira.codehaus.org/browse/MRM-1438

Source: af854a3a-2127-422b-91ae-364da2661108

http://mail-archives.apache.org/mod_mbox/archiva-users/201011.mbox/ajax/%3CAANLkTimXejHAuXdoUKLN=GkNty1_XnRCbv0YA0T2cS_2%40mail.gmail.com%3E

Source: af854a3a-2127-422b-91ae-364da2661108

http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C032C189E-D821-4833-A8F2-F72365147695%40apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/fulldisclosure/2011/Feb/238

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42376

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/43261

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.apache.org/viewvc/archiva/branches/archiva-1.3.x/archiva-modules/archiva-web/archiva-webapp/src/main/resources/struts.xml?r1=1038518&r2=1038517&pathrev=1038518

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://svn.apache.org/viewvc/archiva/branches/archiva-1.3.x/pom.xml?r1=1038518&r2=1038517&pathrev=1038518

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://svn.apache.org/viewvc?view=revision&revision=1038518

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.apache.org/viewvc?view=revision&revision=1066010

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/69520

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/514937/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/516341/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/45095

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1025066

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/3098

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0373

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.