CVE-2011-0650: Cross-site request forgery (CSRF) vulnerability in Greenbone Security Assistant (GSA) before 2.0+rc3 allows...

Security readout for executives and security teams

This vulnerability let an attacker abuse a logged-in Greenbone Security Assistant user’s browser to make GSA send email through OpenVAS Manager. The business risk is higher because the CVE notes it could help bypass authentication requirements when chained with CVE-2011-0018. Exposure appears limited to deployments running Greenbone Security Assistant before 2.0+rc3, especially where privileged users access GSA from browsers that may reach untrusted content. The provided sources do not identify affected package names, distributions, or hosted services beyond GSA/OpenVAS context. Treat as priority remediation for legacy OpenVAS/GSA environments, especially where scanner administration has privileged access. The direct flaw is CSRF, but the cited chaining note raises impact beyond nuisance actions. No current active exploitation evidence is provided in the bundle. Mitigation focus: Upgrade GSA to 2.0+rc3 or later where vendor guidance confirms remediation.; Review OpenVAS advisory OVSA20110118 and linked commit references for fixed revisions.; Restrict administrative access to GSA to trusted networks and managed browsers..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.