PT-2014-4647 · Foxit · Fox Datadiode

Published 2014-10-19 · Updated 2025-10-03 · CVE-2014-2358

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Fox-IT Fox DataDiode appliances versions prior to 1.7.2

Description The issue affects the administrative web interface in the proxy server, where multiple cross-site request forgery (CSRF) vulnerabilities are present. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests, including creating administrative users, removing administrative users, or changing permissions.

Recommendations For versions prior to 1.7.2, update to version 1.7.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrative web interface to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-2358

Affected Products

Fox Datadiode

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-2358 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-14-269-02 · Note
• https://t.me/cveNotify/137347 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-14-269-02 · Note