tDiary contains a flaw that allows a Cross-Side Request Forgery (CSRF). This flaw exists because the application does not verify that requests to privileged URLs come from appropriate tDiary web pages. This could allow a user to create a malicious URL (within or outside the tDiary application) which if followed by an authenticated tDiary user, causes privileged actions to happen on behalf of the tDiary user or web server. This flaw can be used to delete tDiary entries, change tDiary configurations, and execute privileged commands on behalf of the web server.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Unknown
Disclosure:
OSVDB Verified
OSVDB:
Web Related
Solution
Upgrade to stable release 2.0.2 or higher, or development release 2.1.2 or higher as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds or patches.
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
