CVE-2008-3421

Multiple cross-site request forgery (CSRF) vulnerabilities in Blackboard Academic Suite 8.0.260.7 allow remote attackers to hijack the authentication of student users for requests that change configuration and enrollments via unspecified input to (1) update_module.jsp, (2) enroll_course.pl, and (3) unenroll.jsp.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://ceaseless.ws/bb-csrf/	URL Repurposed
http://secunia.com/advisories/31177	Vendor Advisory
http://www.securitytracker.com/id?1020559
https://exchange.xforce.ibmcloud.com/vulnerabilities/43986

Configurations

Configuration 1 (hide)

cpe:2.3:a:blackboard:blackboard_academic_suite:8.0.260.7:*:*:*:*:*:*:*

History

14 Feb 2024, 01:17

Type	Values Removed	Values Added
References	~~() http://ceaseless.ws/bb-csrf/ -~~	() http://ceaseless.ws/bb-csrf/ - URL Repurposed

Information

Published : 2008-07-31 17:41

Updated : 2024-02-14 01:17

NVD link : CVE-2008-3421

Mitre link : CVE-2008-3421

CVE.ORG link : CVE-2008-3421

JSON object : View

Products Affected

blackboard

blackboard_academic_suite

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2008-3421", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2008-07-31T17:41:00.000", "references": [{"url": "http://ceaseless.ws/bb-csrf/", "tags": ["URL Repurposed"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/31177", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1020559", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43986", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Blackboard Academic Suite 8.0.260.7 allow remote attackers to hijack the authentication of student users for requests that change configuration and enrollments via unspecified input to (1) update_module.jsp, (2) enroll_course.pl, and (3) unenroll.jsp."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de falsificaci\u00f3n de tipo cross-site request forgery (CSRF) en Blackboard Academic Suite versi\u00f3n 8.0.260.7, permiten a los atacantes remotos secuestrar la autenticaci\u00f3n de los usuarios alumnos para las peticiones que cambian la configuraci\u00f3n e inscripciones mediante entradas no especificadas en los archivos (1) update_module.jsp, (2) enroll_course.pl y (3) unenroll.jsp."}], "lastModified": "2024-02-14T01:17:43.863", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:blackboard:blackboard_academic_suite:8.0.260.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "090EBB60-326B-442C-9CAF-3A4E3A058D84"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}