|
|
| |
|
| |
cherokee: multiple vulnerabilities
| Package(s): | cherokee |
CVE #(s): | CVE-2011-2190
CVE-2011-2191
|
| Created: | September 26, 2011 |
Updated: | November 25, 2011 |
| Description: |
The Cherokee server admin configuration web interface is vulnerable to CSRF. If an admin is logged into the Cherokee admin
interface and visits a site which runs a malicious script, Cherokee can be
reconfigured to execute arbitrary commands. It is also vulnerable to use
the CSRF to produce a persistent XSS. (CVE-2011-2091)
Cherokee seeds srand with a combination of the time and the PID of the admin process, after which rand() is called to generate a random password -- this is unsafe and allows for fairly easy local
password guessing by a local user. (CVE-2011-2090)
|
| Alerts: |
|
( Log in to post comments)
|
|
|