Homepage

Cross-site Request Forgery (CSRF) The advisory has been revoked - it doesn't affect any version of package kde4libs  (opens in a new tab)

Threat Intelligence

EPSS
0.58% (78th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cross-site Request Forgery (CSRF) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-DEBIAN10-KDE4LIBS-602342
  • published13 Nov 2009
  • disclosed13 Nov 2009
Report a new vulnerability Found a mistake?

Introduced: 13 Nov 2009

CVE-2009-2816  (opens in a new tab)
CWE-352  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kde4libs package and not the kde4libs package as distributed by Debian.

The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.

References