PT-2019-2443 · Cisco · Cisco Prime Service Catalog

Alexander Barakazian + 1 · Publicado 2019-06-19 · Atualizado 2019-06-24 · CVE-2019-1874

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Prime Service Catalog (affected versions not specified)

Description The issue is related to a lack of protection against cross-site request forgery (CSRF) attacks in the web-based management interface. An attacker could exploit this by persuading a user to follow a malicious link, potentially allowing the attacker to perform arbitrary actions on the affected system with the privilege level of the affected user.

Recommendations For all affected versions, consider restricting access to the web-based management interface until a fix is available. As a temporary workaround, avoid using links from untrusted sources to minimize the risk of exploitation. Restrict user privileges to minimize the impact of a potential attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2019-02221

CVE-2019-1874

Produtos afetados

Cisco Prime Service Catalog

Referências · 8

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-psc-csrf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1874 · Aviso do Fabricante
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&last_published=2019+Jun&sort=-day_sir&limit=50#~Vulnerabilities · Nota
• https://bdu.fstec.ru/vul/2019-02221 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1874 · Nota de Segurança
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&last_published=2019+Jun&sort=-day_sir&limit=50#~Vulnerabilities · Nota
• http://securityfocus.com/bid/108861 · Nota
• https://vuldb.com/?id.136734 · Nota