« Back to list

CVE-2009-2738

Status: ModifiedMedium (4.3)—

Cross-site request forgery (CSRF) vulnerability in the WebGUI in FreeNAS before 0.7RC1 allows remote attackers to hijack the authentication of users for unspecified requests via unknown vectors.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Freenas — Freenas

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2009-2738",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-08-11T18:30:01.017",
  "references": [
    {
      "url": "http://jvn.jp/en/jp/JVN15267895/index.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000053.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.freenas.org/index.php?option=com_frontpage&Itemid=22",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.ipa.go.jp/security/vuln/documents/2009/200908_freenas.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://jvn.jp/en/jp/JVN15267895/index.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000053.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.freenas.org/index.php?option=com_frontpage&Itemid=22",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ipa.go.jp/security/vuln/documents/2009/200908_freenas.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in the WebGUI in FreeNAS before 0.7RC1 allows remote attackers to hijack the authentication of users for unspecified requests via unknown vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en Interfaz de usuario web en FreeNAS anteriores a v0.7RC1 permite a atacantes remotos secuestras la autenticación de los usuarios por peticiones sin especificar a través de vectores desconocidos."
    }
  ],
  "lastModified": "2026-06-16T23:10:08.190",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:freenas:freenas:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4FAB5C2-6CA0-4B1D-A630-F428FAA0A8B9",
              "versionEndIncluding": "0.69.2"
            },
            {
              "criteria": "cpe:2.3:a:freenas:freenas:0.69.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "869D3D88-5520-4B03-A542-6670CDE6AE9D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}