« Volver al listado

CVE-2014-1615

Estado: ModificadaMedia (6.8)—

Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Carbonblack — Carbon Black

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-1615",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-04-22T14:23:35.283",
  "references": [
    {
      "url": "http://secunia.com/advisories/57645",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/57645",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de CSRF en Carbon Black anterior a 4.1.0 permiten a atacantes remotos secuestrar la autenticación de administradores para solicitudes que añaden usuarios administrativos nuevos y tener otra acción no especificada, tal y como fue demostrado por una solicitud hacia api/user."
    }
  ],
  "lastModified": "2026-06-17T00:05:17.620",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:carbonblack:carbon_black:*:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90E2E7E6-BA01-4C60-9E8D-B7B6B17C399B",
              "versionEndIncluding": "4.1.0"
            },
            {
              "criteria": "cpe:2.3:a:carbonblack:carbon_black:4.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1673B83-5DCC-4C5E-BE19-0C1814A16EA2"
            },
            {
              "criteria": "cpe:2.3:a:carbonblack:carbon_black:4.1.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A4F72AF-221D-40D4-805C-72A3D90445B5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}