« Volver al listado

CVE-2005-2411

Estado: ModificadaMedia (5.1)—

Vulnerabilidad "Cross-Site Request Forgery" en tDiary 2.1.1 y 2.0.1 y anteriores, permite que atacantes remotos ejecuten acciones como otro usuario y ejecuten comandos en el servidor (mediante una URL que es activada por el usuario).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tdiary — Tdiary

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2005-2411",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.1,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "HIGH",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "security@debian.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2005-08-01T04:00:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/16329",
      "source": "security@debian.org"
    },
    {
      "url": "http://secunia.com/advisories/16787",
      "source": "security@debian.org"
    },
    {
      "url": "http://sourceforge.net/forum/forum.php?forum_id=482743",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.debian.org/security/2005/dsa-808",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.osvdb.org/18604",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/14500",
      "source": "security@debian.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/21735",
      "source": "security@debian.org"
    },
    {
      "url": "http://secunia.com/advisories/16329",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/16787",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sourceforge.net/forum/forum.php?forum_id=482743",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2005/dsa-808",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/18604",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/14500",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/21735",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Request Forgery (CSRF) vulnerability in tDiary 2.1.1, and tDiary 2.0.1 and earlier, allows remote attackers to conduct actions as another user, and execute commands on the server, via a URL that is activated by the user."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad \"Cross-Site Request Forgery\" en tDiary 2.1.1 y 2.0.1 y anteriores, permite que atacantes remotos ejecuten acciones como otro usuario y ejecuten comandos en el servidor (mediante una URL que es activada por el usuario)."
    }
  ],
  "lastModified": "2026-06-16T22:14:50.347",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tdiary:tdiary:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44FFB6E0-3B54-47CA-910C-A3E564FCF2E2",
              "versionEndIncluding": "2.0.1"
            },
            {
              "criteria": "cpe:2.3:a:tdiary:tdiary:2.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D008FDC5-C6EB-4616-8B56-A210A552F840"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@debian.org"
}