« Volver al listado

CVE-2009-4555

Estado: ModificadaMedia (6.8)—

Multiple cross-site request forgery (CSRF) vulnerabilities in AgoraCart 5.2.005 and 5.2.006 and AgoraCart GOLD 5.5.005 allow remote attackers to hijack the authentication of administrators for requests that (1) modify a .htaccess file via an unspecified request to protected/manager.cgi or (2) change the password of an administrative account.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

K-factor — Agoracart

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-4555",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-01-04T21:30:00.390",
  "references": [
    {
      "url": "http://holisticinfosec.org/content/view/129/45/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/36789",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53808",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://holisticinfosec.org/content/view/129/45/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/36789",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53808",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in AgoraCart 5.2.005 and 5.2.006 and AgoraCart GOLD 5.5.005 allow remote attackers to hijack the authentication of administrators for requests that (1) modify a .htaccess file via an unspecified request to protected/manager.cgi or (2) change the password of an administrative account."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de Falsificación de petición en sitios cruzados (CSRF) en AgoraCart v5.2.005 y v5.2.006 y AgoraCart GOLD v5.5.005, permite a atacantes remotos secuestrar las peticiones de autenticación de los administradores que (1) modifican el archivo .htaccess a través de una petición a protected/manager.cgi o (2) modifican la contraseña para la cuenta de administrador."
    }
  ],
  "lastModified": "2026-06-16T23:13:53.200",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:k-factor:agoracart:-:gold:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A312E2A7-D830-4552-AE37-44C96FE8A071"
            },
            {
              "criteria": "cpe:2.3:a:k-factor:agoracart:5.2.005:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECDDD617-B7D3-4E00-B405-9CB88331C1FD"
            },
            {
              "criteria": "cpe:2.3:a:k-factor:agoracart:5.2.006:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "129FDEEE-FA4A-4F9F-9A10-3E935247D589"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}