PT-2014-3117 · Red Hat+1 · Cloudforms Management Engine+1

Martin Povolný · Published 2014-01-23 · Updated 2014-01-23 · CVE-2013-6443

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CloudForms Management Engine versions prior to 5.2.1.6

Description The issue allows remote attackers to bypass the Ruby on Rails protect from forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.

Recommendations For versions prior to 5.2.1.6, update to version 5.2.1.6 or later to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2013-6443

RHSA-2014:0025

Affected Products

Cloudforms Management Engine

Ruby On Rails

References · 3

• http://rhn.redhat.com/errata/RHSA-2014-0025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6443 · Security Note
• http://securitytracker.com/id/1029606 · Note