PT-2014-3117 · Red Hat+1 · Cloudforms Management Engine+1

Martin Povolný · Publicado 2014-01-23 · Atualizado 2014-01-23 · CVE-2013-6443

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CloudForms Management Engine versions prior to 5.2.1.6

Description The issue allows remote attackers to bypass the Ruby on Rails protect from forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.

Recommendations For versions prior to 5.2.1.6, update to version 5.2.1.6 or later to resolve the issue.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2013-6443

RHSA-2014:0025

Produtos afetados

Cloudforms Management Engine

Ruby On Rails

Referências · 3

• http://securitytracker.com/id/1029606 · Nota
• http://rhn.redhat.com/errata/RHSA-2014-0025.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-6443 · Nota de Segurança