PT-2015-2609 · Janitza · Janitza Umg

Published 2015-10-28 · Updated 2015-10-28 · CVE-2015-3967

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Janitza UMG versions 508, 509, 511, 604, 605

Description The issue is related to a cross-site request forgery (CSRF) vulnerability, which allows remote attackers to hijack the authentication of arbitrary users. This means an attacker could potentially use this vulnerability to act on behalf of another user without their knowledge or consent.

Recommendations For Janitza UMG versions 508, 509, 511, 604, 605, consider implementing additional authentication measures to prevent CSRF attacks, such as token-based validation for each request. As a temporary workaround, restrict access to sensitive areas of the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2015-11974

CVE-2015-3967

Affected Products

Janitza Umg

References · 3

• https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-3967 · Security Note
• https://bdu.fstec.ru/vul/2015-11974 · Security Note