CVE Vulnerability

CVE-2007-3489

Cross-site request forgery (CSRF) vulnerability in pop/WizU.html in the management interface in Check Point VPN-1 Edge X Embedded NGX 7.0.33x on the Check Point VPN-1 UTM Edge allows remote attackers to perform privileged actions as administrators, as demonstrated by a request with the swuuser and swupass parameters, which adds an administrator account. NOTE: the CSRF attack has no timing window because there is no logout capability in the management interface.

9.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

References
Link Resource
http://www.louhi.fi/advisory/checkpoint_070626.txt
http://secunia.com/advisories/25853 Patch Vendor Advisory
http://securityreason.com/securityalert/2848
http://www.vupen.com/english/advisories/2007/2363
http://osvdb.org/37645
https://exchange.xforce.ibmcloud.com/vulnerabilities/35103
http://www.securityfocus.com/archive/1/472371/100/0/threaded
Configurations

Configuration 1

cpe:2.3:h:checkpoint:vpn-1_utm_edge:7.0.33:*:utm_edge:*:*:*:*:*
Information

Published : 2007-06-29 06:30

Updated : 2018-10-16 04:50

NVD link : CVE-2007-3489

Mitre link : CVE-2007-3489

Products Affected
No products.
CWE
NVD-CWE-Other