CSRF in Luke Mewburn Tnftpd
CVE-2008-7016
tnftpd before 20080929 splits large command strings into multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unknown vectors, probably involving a crafted ftp:// link to a tnftpd server.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.006 (44.3th percentile) — read the EPSS interpretation.
Affected products
- Luke_mewburn Tnftpd — versions 20040810, 20061217, 20080609
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (vdb-entry, x_refsource_XF)