Published: 29/07/2011 Updated: 29/08/2022

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 685

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x prior to 3.5.10 allow remote malicious users to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program.

Vulnerable Product	Search on Vulmon	Subscribe to Product
samba samba
debian debian linux 5.0
debian debian linux 7.0
debian debian linux 6.0
canonical ubuntu linux 10.10
canonical ubuntu linux 11.04
canonical ubuntu linux 8.04
canonical ubuntu linux 10.04

An attacker could use a malicious URL to reconfigure Samba or steal information ...

<!-- # Secur-I Research Group - Proof-of-Concept # ========================================================================== # Title: Cross-Site Request Forgery in SWAT (Samba Web Administration Tool) # Vulnerable versions: Samba 30x - 359 (inclusive) # Fixed version: Samba 3510 # Product Homepage: wwwsambaorg/ # CVE-ID: CVE-2011 ...

SWAT (Samba Web Administration Tool) in Samba versions 30x through 359 suffers from a cross site request forgery vulnerability ...

CWE-352 https://bugzilla.redhat.com/show_bug.cgi?id=721348 http://samba.org/samba/history/samba-3.5.10.html http://www.samba.org/samba/security/CVE-2011-2522 http://www.mandriva.com/security/advisories?name=MDVSA-2011:121 http://jvn.jp/en/jp/JVN29529126/index.html http://www.securityfocus.com/bid/48899 http://www.exploit-db.com/exploits/17577 http://securitytracker.com/id?1025852 http://secunia.com/advisories/45393 https://bugzilla.samba.org/show_bug.cgi?id=8290 http://osvdb.org/74071 http://secunia.com/advisories/45496 http://secunia.com/advisories/45488 http://www.debian.org/security/2011/dsa-2290 http://ubuntu.com/usn/usn-1182-1 http://securityreason.com/securityalert/8317 http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543 https://exchange.xforce.ibmcloud.com/vulnerabilities/68843 http://marc.info/?l=bugtraq&m=133527864025056&w=2 https://usn.ubuntu.com/1182-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/17577/

CVE-2011-2522

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect