Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2020-3456

Опубликовано: 21 окт. 2020
Источник: nvd
CVSS3: 8.8
CVSS2: 6.8
EPSS Низкий

Описание

A vulnerability in the Cisco Firepower Chassis Manager (FCM) of Cisco FXOS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected device. The vulnerability is due to insufficient CSRF protections for the FCM interface. An attacker could exploit this vulnerability by persuading a targeted user to click a malicious link. A successful exploit could allow the attacker to send arbitrary requests that could take unauthorized actions on behalf of the targeted user.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:cisco:firepower_extensible_operating_system:2.4\(1.249\):*:*:*:*:*:*:*

Одно из

cpe:2.3:h:cisco:firepower_4110:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_4112:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_4115:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_4120:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_4125:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_4140:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_4145:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_4150:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_9300_sm-24:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_9300_sm-36:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_9300_sm-40:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_9300_sm-44:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_9300_sm-44_x_3:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_9300_sm-48:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_9300_sm-56:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_9300_sm-56_x_3:-:*:*:*:*:*:*:*

EPSS

Процентиль: 48%
0.0025
Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352
CWE-352

Связанные уязвимости

github логотип

GHSA-327p-j9g4-qf3q

github
больше 3 лет назад

A vulnerability in the Cisco Firepower Chassis Manager (FCM) of Cisco FXOS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected device. The vulnerability is due to insufficient CSRF protections for the FCM interface. An attacker could exploit this vulnerability by persuading a targeted user to click a malicious link. A successful exploit could allow the attacker to send arbitrary requests that could take unauthorized actions on behalf of the targeted user.

fstec логотип

BDU:2020-05688

CVSS3: 8.8
fstec
больше 5 лет назад

Уязвимость интерфейса мониторинга и управления операционной системы Cisco FXOS межсетевого экрана Cisco Firepower, позволяющая нарушителю осуществить CSRF-атаку

EPSS

Процентиль: 48%
0.0025
Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352
CWE-352