CVE-2014-3267

Опубликовано: 26 мая 2014

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make unspecified changes, aka Bug ID CSCuo46427.

Ссылки

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3267
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=34325
Vendor Advisory
http://www.securitytracker.com/id/1030271
Third Party Advisory
VDB Entry
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3267
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=34325
Vendor Advisory
http://www.securitytracker.com/id/1030271
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:security_manager:*:*:*:*:*:*:*:*

Версия до 4.6 (включая)

cpe:2.3:a:cisco:security_manager:4.0:-:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.0:sp1:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.0.1:-:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.0.1:sp1:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.0.1:sp2:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.1:*:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.1:sp1:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.1:sp2:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.2:-:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.2:sp1:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.3:-:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.3:sp1:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.3:sp2:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.4:-:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.4:sp1:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.4:sp2:*:*:*:*:*:*

cpe:2.3:a:cisco:security_manager:4.5:*:*:*:*:*:*:*

EPSS

Процентиль: 33%

0.00128

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-f6x9-ch9p-q4q6

github

больше 3 лет назад