CVE-2011-2522: canonical ubuntu_linux Cross-Site Request Forgery
Vulnerability summary
CVE-2011-2522 is a medium (CVSS 6.8) Cross-Site Request Forgery vulnerability in canonical ubuntu_linux. EPSS estimates a 10.62% chance of exploitation in the next 30 days, higher than 95.7% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 1Timeline
- 29-07-2011PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
10.62%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
Increase +0.58 pp
From 10.05% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundSWAT Samba Web Administration Tool - Cross-Site Request Forgery
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- samba< 2:3.5.10~dfsg-1
- debian_linuxEOL5.0 | 6.0 | 7.0
Canonical1 product
- ubuntu_linuxEOL8.04 | 10.04 | 10.10 | 11.04
Samba1 product
- samba≥ 3.0.0, < 3.3.16 | ≥ 3.4.0, < 3.4.14 | ≥ 3.5.0, < 3.5.10
3 vendors · 4 products
References
20 links- www.mandriva.com/security/advisories?name=MDVSA-2011:121Vendor AdvisoryX Refsource MANDRIVABroken Link
- www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543Vendor AdvisoryX Refsource HPBroken Link
- marc.info?l=bugtraq&m=133527864025056&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
Show all 20 references
- bugzilla.redhat.com/show_bug.cgi?id=721348X Refsource CONFIRMIssue TrackingPatchThird Party Advisory