NVD

Id
4097  
Name
CVE-2008-4247  
Description
ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2008-09-25  
Modified Date
2012-10-22  
Seq
2008-4247  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
26102 4097 CVE-2008-4247 NetBSD-SA2008-014  View
26103 4097 CVE-2008-4247 http://bugs.proftpd.org/show_bug.cgi?id=3115  View
26104 4097 CVE-2008-4247 FreeBSD-SA-08:12  View
26105 4097 CVE-2008-4247 20080926 multiple vendor ftpd - Cross-site request forgery  View
26106 4097 CVE-2008-4247 4313  View
26107 4097 CVE-2008-4247 http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y  View
26108 4097 CVE-2008-4247 http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h  View
26109 4097 CVE-2008-4247 http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c  View
26110 4097 CVE-2008-4247 http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h  View
26111 4097 CVE-2008-4247 http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html  View
26112 4097 CVE-2008-4247 1020946  View
26113 4097 CVE-2008-4247 1021112  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
47122 JVNDB-2008-002432 複数の製品の ftpd におけるクロスサイトリクエストフォージェリの脆弱性 複数の製品の ftpd には、FTP クライアントからの長大なコマンドの読み取りに関する処理に不備があるため、クロスサイトリクエストフォージェリ攻撃を誘発される、および任意の FTP コマンドを実行される脆弱性が存在します。 CVE-2008-4247 34360 CVE-2008-4247 4097 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002432.html 2008-09-25 2010-08-03 View