« Volver al listado

CVE-2006-4582

Estado: ModificadaMedia (5)—

Vulnerabilidad en la falsificación de petición en sitios cruzados (CSRF) en el Address Book 1.04e permite a atacantes remotos la realización de acciones no autorizadas, como otros usuarios, mediante vectores sin especificar, como lo demostrado mediante el borrado de usuarios de nuestra elección a través del parámetro id en la acción deleteuser en el users.php.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

THE Address Book — THE Address Book

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-4582",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "PSIRT-CNA@flexerasoftware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-12-31T05:00:00.000",
  "references": [
    {
      "url": "http://osvdb.org/32559",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://secunia.com/advisories/21694",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://secunia.com/secunia_research/2006-76/advisory/",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31251",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://osvdb.org/32559",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/21694",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/secunia_research/2006-76/advisory/",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31251",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en la falsificación de petición en sitios cruzados (CSRF) en el Address Book 1.04e permite a atacantes remotos la realización de acciones no autorizadas, como otros usuarios, mediante vectores sin especificar, como lo demostrado mediante el borrado de usuarios de nuestra elección a través del parámetro id en la acción deleteuser en el users.php."
    }
  ],
  "lastModified": "2026-06-16T22:29:23.597",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:the_address_book:the_address_book:1.04e:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "987F84E0-1A6B-484B-B973-9AE2E3ADB435"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "PSIRT-CNA@flexerasoftware.com"
}