CVE-2008-6479

EPSS 1.2%

Cross-site request forgery (CSRF) vulnerability in the "change password" feature in the VZPP web interface for Parallels Virtuozzo 25.4.swsoft (build 3.0.0-25.4.swsoft) allows remote attackers to modify the password via a link or IMG tag to vz/cp/pwd.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/31604unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/44394 http://px.dynalias.org/files/virtuozzo_pwd.html.txt http://secunia.com/advisories/29675 https://exchange.xforce.ibmcloud.com/vulnerabilities/41638 http://www.securityfocus.com/archive/1/490409/100/0/threaded http://www.securityfocus.com/bid/28593