Cross-site request forgery vulnerability in FreeNAS


FreeNAS contains a cross-site request forgery vulnerability.

FreeNAS is a NAS (Network Attached Storage) server software. FreeNAS contains a cross-site request forgery vulnerability.

Hiroyuki Shinshiba of LAC:Little eArth Corporation Co., LTD. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 7.1 (High) [IPA Score]
  • Access Vector: Network
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: Complete
  • Availability Impact: Complete
Affected Products

FreeNAS Project
  • FreeNAS 0.69.2 and earlier


If a user views a malicious web page while logged into the web-based interface, an attacker could modify configurations or delete data on the hard disk drive.

[Update the Software]
Update to the latest version according to the information provided by the developer. The version that addresses this vulnerability was released as FreeNAS 0.7RC1.
Vendor Information

FreeNAS Project
CWE (What is CWE?)

  1. Cross-Site Request Forgery(CWE-352) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2009-2738

  1. JVN : JVN#15267895
  2. National Vulnerability Database (NVD) : CVE-2009-2738
  3. IPA SECURITY ALERTS : Security Alert for Vulnerability in FreeNAS
Revision History

  • [2009/08/05]
      Web page published