CVE-2017-9810

EPSS 1.9%

There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.htmlunverified cve_referencewww.exploit-db.com/exploits/42269/unverified exploitdbwww.exploit-db.com/exploits/42269unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html http://seclists.org/fulldisclosure/2017/Jun/33 https://www.coresecurity.com/advisories/kaspersky-anti-virus-file-server-multiple-vulnerabilities https://www.exploit-db.com/exploits/42269/http://www.securityfocus.com/bid/99330 http://www.securitytracker.com/id/1038798