PT-2014-8843 · Huawei · Huawei Fusionmanager+1

Published 2014-09-24 · Updated 2017-04-05 · CVE-2014-9136

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Huawei FusionManager versions V100R002C03 through V100R003C00

Description The issue allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against the user of the web interface. CSRF is a type of attack where an attacker tricks a user into performing unintended actions on a web application that the user is authenticated to. This can happen when a user is logged into the web interface and an attacker sends a malicious request to the user's browser, which then executes the request without the user's knowledge.

Recommendations For Huawei FusionManager versions V100R002C03 and V100R003C00, consider implementing CSRF protection mechanisms, such as token-based validation, to prevent unauthorized requests. As a temporary workaround, restrict access to the web interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-9136

Affected Products

Huawei Fusionmanager

Huawei Vrp

References · 4

• http://huawei.com/en/psirt/security-advisories/hw-372186 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9136 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-9136 · Security Note
• https://huawei.com/en/psirt/security-advisories/hw-372186 · Note