CVE-2016-1607
HighSummary
Multiple CSRF vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers to hijack the authentication of administrators, as demonstrated by reconfiguring time settings via a vaconfig/time request.
Risk Assessment
Attackers can take control of administrator accounts, leading to serious security breaches and potential data loss.
Recommendation
It is recommended to update Novell Filr to a version after 2.0 Security Update 2 and implement additional protections against CSRF attacks.
Other vulnerabilities in Novell Filr
See all- CVE-2016-1611High
Novell Filr version 1.2 before Hot Patch 6 and 2.0 before Hot Patch 2 has world-writable permissions for the /etc/profile.d/vainit.sh file, allowing local users to gain elevated privileges by replacing this file's content with arbitrary shell commands.
- CVE-2016-1610High
Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name.
- CVE-2016-1608High
In Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2, remote authenticated users can execute arbitrary commands via shell metacharacters in the ntpServer parameter.
Original NVD description (English source)
Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers to hijack the authentication of administrators, as demonstrated by reconfiguring time settings via a vaconfig/time request.