CVE-2008-3736

Status: ModifiedMedium (6)—

Multiple cross-site request forgery (CSRF) vulnerabilities in (1) System Consultants La!Cooda WIZ 1.4.0 and earlier and (2) SpaceTag LacoodaST 2.1.3 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (a) change passwords or (b) change configurations.

CVSS

Version: 2.0
Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
Base score: 6

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.56%
Percentile among all scored CVEs: 45
Score date: 10/5/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (2)

Spacetag — Lacoodast System Consultants — LA Cooda WIZ

CWEs

CWE-352

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2008-3736",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-08-27T20:41:00.000",
  "references": [
    {
      "url": "http://jvn.jp/en/jp/JVN83428818/index.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/31574",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/31582",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://wiz.syscon.co.jp/Details.htm",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/30791",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44592",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://jvn.jp/en/jp/JVN83428818/index.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/31574",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/31582",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://wiz.syscon.co.jp/Details.htm",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/30791",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44592",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in (1) System Consultants La!Cooda WIZ 1.4.0 and earlier and (2) SpaceTag LacoodaST 2.1.3 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (a) change passwords or (b) change configurations."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de cross-site request forgery (CSRF) en (1) La!Cooda WIZ de System Consultants versión 1.4.0 y anteriores y (2) LacoodaST de SpaceTag versión 2.1.3 y anteriores, permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios para peticiones que (a) cambien contraseñas o (b) cambien configuraciones."
    }
  ],
  "lastModified": "2026-06-16T22:56:26.403",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:spacetag:lacoodast:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FC83794-AF5E-4132-9D39-DDFCC4676AAC",
              "versionEndIncluding": "2.1.3"
            },
            {
              "criteria": "cpe:2.3:a:system_consultants:la_cooda_wiz:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D37B18AD-ED65-4D9B-92D1-80C0D74E98CB",
              "versionEndIncluding": "1.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}