PT-2014-8844 · Huawei · Huawei S5100+4

Publicado 2014-09-24 · Atualizado 2017-04-07 · CVE-2014-9137

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Huawei USG9500 versions V200R001C01SPC800 and earlier Huawei USG2100 versions V300R001C00SPC900 and earlier Huawei USG2200 version V300R001C00SPC900 Huawei USG5100 version V300R001C00SPC900

Description The issue allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against the user of the web interface. This type of attack can occur when a user is tricked into performing unintended actions on a web application that they are authenticated to.

Recommendations For Huawei USG9500 versions V200R001C01SPC800 and earlier, update to a version later than V200R001C01SPC800 to resolve the issue. For Huawei USG2100 versions V300R001C00SPC900 and earlier, update to a version later than V300R001C00SPC900 to resolve the issue. For Huawei USG2200 version V300R001C00SPC900, update to a version later than V300R001C00SPC900 to resolve the issue. For Huawei USG5100 version V300R001C00SPC900, update to a version later than V300R001C00SPC900 to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-9137

Produtos afetados

Huawei Usg2100

Huawei Usg2200

Huawei S5100

Huawei Usg9500

Huawei Vrp

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-9137 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9137 · Nota de Segurança
• http://huawei.com/en/psirt/security-advisories/hw-372186 · Aviso do Fabricante
• https://huawei.com/en/psirt/security-advisories/hw-372186 · Nota