« Volver al listado

CVE-2013-3935

Estado: ModificadaAlta (8.8)—

Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.1 and Opsview Core before 20130522 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Opsview — OpsviewOpsview — Opsview Core

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-3935",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "PSIRT-CNA@flexerasoftware.com",
      "affectedData": [
        {
          "vendor": "Opsview",
          "product": "Opsview",
          "versions": [
            {
              "status": "affected",
              "version": "before 4.4.1"
            }
          ]
        },
        {
          "vendor": "Opsview",
          "product": "Opsview Core",
          "versions": [
            {
              "status": "affected",
              "version": "before 20130522"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-01-02T15:15:11.413",
  "references": [
    {
      "url": "http://docs.opsview.com/doku.php?id=opsview-core:changes#opsview_core_20130822",
      "tags": [
        "Release Notes"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://docs.opsview.com/doku.php?id=opsview4.4:changes#fixes",
      "tags": [
        "Broken Link"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://docs.opsview.com/doku.php?id=opsview-core:changes#opsview_core_20130822",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://docs.opsview.com/doku.php?id=opsview4.4:changes#fixes",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.1 and Opsview Core before 20130522 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo cross-site request forgery (CSRF) en Opsview versiones anteriores a la versión 4.4.1 y Opsview Core versiones anteriores a la versión  20130522, permite a atacantes remotos secuestrar la autenticación de administradores para peticiones que cambian la contraseña de administrador por medio de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-16T23:56:02.963",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opsview:opsview:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5394676A-D216-4650-80AF-ED7F1543AB0F",
              "versionEndExcluding": "4.4.1"
            },
            {
              "criteria": "cpe:2.3:a:opsview:opsview_core:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D21F51C8-99B8-491C-8F22-CBD005968DA9",
              "versionEndExcluding": "20130522"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "PSIRT-CNA@flexerasoftware.com"
}