CVE-2008-4247: freebsd Cross-Site Request Forgery (CSRF)

CVSS: 7.5v2.0HighModified

AliasesDEBIAN-CVE-2008-4247

Published 25-09-2008Last modified 07-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2008-4247 is a high (CVSS 7.5) Cross-Site Request Forgery (CSRF) vulnerability in freebsd. EPSS estimates a 5.25% chance of exploitation in the next 30 days, higher than 92.4% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

41/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

5.25%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3reference, exploit-database

Timeline

25-09-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

5.25%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

0.00 pp

From 5.25% on 20-09-2026

20-09-202620-10-2026

EPSS score

5.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (openbsd.org)
Maturity: unknown
referenceUnverified
Exploit Reference (openbsd.org)
Maturity: unknown
exploit-databaseremoteunixVerified
Multiple Vendor FTP Server - Long Command Handling Security
Maturity: weaponized