PT-2017-8509 · Meteocontrol · Meteocontrol Web'Log Light+3

Published 2017-03-21 · Updated 2017-03-24 · CVE-2016-4504

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Meteocontrol WEB'log Basic versions all Meteocontrol WEB'log Light versions all Meteocontrol WEB'log Pro versions all Meteocontrol WEB'log Pro Unlimited versions all

Description A Cross-Site Request Forgery issue was found, where no CSRF Token is generated per page or per function, allowing for potential exploitation.

Recommendations For Meteocontrol WEB'log Basic, consider implementing a CSRF token generation mechanism per page or per function as a mitigation measure. For Meteocontrol WEB'log Light, consider implementing a CSRF token generation mechanism per page or per function as a mitigation measure. For Meteocontrol WEB'log Pro, consider implementing a CSRF token generation mechanism per page or per function as a mitigation measure. For Meteocontrol WEB'log Pro Unlimited, consider implementing a CSRF token generation mechanism per page or per function as a mitigation measure.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2016-4504

Affected Products

Meteocontrol Web'Log Basic

Meteocontrol Web'Log Light

Meteocontrol Web'Log

Meteocontrol Web'Log Pro Unlimited

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2016-4504 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-133-01 · Note