PT-2014-8843 · Huawei · Huawei Fusionmanager+1

Publicado 2014-09-24 · Atualizado 2017-04-05 · CVE-2014-9136

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Huawei FusionManager versions V100R002C03 through V100R003C00

Description The issue allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against the user of the web interface. CSRF is a type of attack where an attacker tricks a user into performing unintended actions on a web application that the user is authenticated to. This can happen when a user is logged into the web interface and an attacker sends a malicious request to the user's browser, which then executes the request without the user's knowledge.

Recommendations For Huawei FusionManager versions V100R002C03 and V100R003C00, consider implementing CSRF protection mechanisms, such as token-based validation, to prevent unauthorized requests. As a temporary workaround, restrict access to the web interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-9136

Produtos afetados

Huawei Fusionmanager

Huawei Vrp

Referências · 4

• http://huawei.com/en/psirt/security-advisories/hw-372186 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9136 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-9136 · Nota de Segurança
• https://huawei.com/en/psirt/security-advisories/hw-372186 · Nota