Cross-Site Request Forgery Vulnerabilities in IBM BladeCenter's Advanced Management Module

CVE-2009-1290

Summary

The Advanced Management Module (AMM) on IBM's BladeCenter products, including BladeCenter H with BPET36H 54, contains multiple vulnerabilities that allow remote attackers to exploit CSRF. This can lead to unauthorized actions being taken on behalf of authenticated administrators, potentially resulting in significant management disruptions. An example of this exploit involves sending a power-off request through the private/blade_power_action script, granting attackers the ability to hijack administrative sessions.

References