PT-2017-8509 · Meteocontrol · Meteocontrol Web'Log Light+3

Publicado 2017-03-21 · Atualizado 2017-03-24 · CVE-2016-4504

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Meteocontrol WEB'log Basic versions all Meteocontrol WEB'log Light versions all Meteocontrol WEB'log Pro versions all Meteocontrol WEB'log Pro Unlimited versions all

Description A Cross-Site Request Forgery issue was found, where no CSRF Token is generated per page or per function, allowing for potential exploitation.

Recommendations For Meteocontrol WEB'log Basic, consider implementing a CSRF token generation mechanism per page or per function as a mitigation measure. For Meteocontrol WEB'log Light, consider implementing a CSRF token generation mechanism per page or per function as a mitigation measure. For Meteocontrol WEB'log Pro, consider implementing a CSRF token generation mechanism per page or per function as a mitigation measure. For Meteocontrol WEB'log Pro Unlimited, consider implementing a CSRF token generation mechanism per page or per function as a mitigation measure.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2016-4504

Produtos afetados

Meteocontrol Web'Log Basic

Meteocontrol Web'Log Light

Meteocontrol Web'Log

Meteocontrol Web'Log Pro Unlimited

Referências · 2

• https://ics-cert.us-cert.gov/advisories/ICSA-16-133-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4504 · Nota de Segurança