PT-2011-31: Multiple Cross-Site Request Forgery vulnerabilities in Citrix XenServer Web Self Service Vulnerable softwareCitrix XenServer Web Self Service Version: 1.1 and earlier Link: http://www.citrix.com/English/ps2/products/feature.asp?contentID=2316933Severity levelSeverity level: High Impact: Configuration modification Access Vector: Remote CVSS v2: Base Score: 7.1 Vector: (AV:N/AC:M/Au:N/C:N/I:C/A:N)CVE: not assigned Vulnerability descriptionThe specialists of the Positive Research center have detected "Cross-Site Request Forgery" vulnerabilities in Citrix XenServer Web Self Service.All web interface forms are vulnerable to CSRF attacks. One can exploit these vulnerabilities to change the system configuration.How to fixUpdate your software up to the latest version Advisory status 10.11.2011 - Vendor is notified 10.11.2011 - Vendor gets vulnerability details 10.03.2012 - Vendor releases fixed version and details 28.09.2012 - Public disclosureCreditsThe vulnerability has discovered by Maxim Tsoy, Positive Research Center (Positive Technologies Company)Referenceshttp://en.securitylab.ru/lab/PT-2011-31 http://support.citrix.com/article/CTX132219 Reports on the vulnerabilities previously discovered by Positive Research:http://ptsecurity.com/research/advisory/ http://en.securitylab.ru/lab/