PT-2014-4647 · Foxit · Fox Datadiode

Publicado 2014-10-19 · Atualizado 2025-10-03 · CVE-2014-2358

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Fox-IT Fox DataDiode appliances versions prior to 1.7.2

Description The issue affects the administrative web interface in the proxy server, where multiple cross-site request forgery (CSRF) vulnerabilities are present. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests, including creating administrative users, removing administrative users, or changing permissions.

Recommendations For versions prior to 1.7.2, update to version 1.7.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrative web interface to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-2358

Produtos afetados

Fox Datadiode

Referências · 4

• https://ics-cert.us-cert.gov/advisories/ICSA-14-269-02 · Nota
• https://t.me/cveNotify/137347 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2014-2358 · Nota de Segurança
• https://cisa.gov/news-events/ics-advisories/icsa-14-269-02 · Nota