PT-2015-2609 · Janitza · Janitza Umg

Publicado 2015-10-28 · Atualizado 2015-10-28 · CVE-2015-3967

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Janitza UMG versions 508, 509, 511, 604, 605

Description The issue is related to a cross-site request forgery (CSRF) vulnerability, which allows remote attackers to hijack the authentication of arbitrary users. This means an attacker could potentially use this vulnerability to act on behalf of another user without their knowledge or consent.

Recommendations For Janitza UMG versions 508, 509, 511, 604, 605, consider implementing additional authentication measures to prevent CSRF attacks, such as token-based validation for each request. As a temporary workaround, restrict access to sensitive areas of the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2015-11974

CVE-2015-3967

Produtos afetados

Janitza Umg

Referências · 3

• https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2015-3967 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11974 · Nota de Segurança