PT-2018-1780 · Cisco · Cisco Energy Management Suite

Publicado 2018-11-07 · Atualizado 2019-10-09 · CVE-2018-15445

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Energy Management Suite Software (affected versions not specified)

Description The issue is related to insufficient CSRF protections in the web-based management interface, allowing an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. This could enable the attacker to perform arbitrary actions on an affected device by persuading an authenticated user to follow a crafted link. The exploit could allow the attacker to act with the privileges of the user, via a web browser.

Recommendations For Cisco Energy Management Suite Software, consider implementing additional CSRF protections for the web-based management interface to prevent exploitation. As a temporary workaround, restrict access to the web-based management interface to minimize the risk of exploitation. Avoid using the interface with untrusted or unknown links to prevent potential CSRF attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2018-01380

CVE-2018-15445

Produtos afetados

Cisco Energy Management Suite

Referências · 8

• 🔥 https://tenable.com/security/research/tra-2018-36 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15445 · Nota de Segurança
• https://securitylab.ru/vulnerability/496349.php · Nota
• https://bdu.fstec.ru/vul/2018-01380 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-ems-csrf · Aviso do Fabricante
• https://cybersecurity-help.cz/vdb/SB2018110809?affChecked=1 · Nota
• http://securityfocus.com/bid/105859 · Nota
• https://securityfocus.com/bid/105520/discuss · Nota