CVE-2010-3271 Cross-site request forgery in n/a
Remote attackers can hijack administrator sessions to disable security options in IBM WebSphere Application Server via CSRF.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2010-3271?
CVE-2010-3271 is a medium-severity vulnerability in Ibm Websphere Application Server, published on 18 Jul 2011. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do.
Weakness: CWE-352
Which versions are affected by CVE-2010-3271?
It affects 1 product.
Products include Ibm Websphere Application Server.
How do I fix CVE-2010-3271?
No fix has been published for CVE-2010-3271 yet. Limit exposure of the affected software until one is available.
Is CVE-2010-3271 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-3271 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Ibm Websphere Application Server
Sources
Also known as GHSA-g9g3-hphr-q46f.