« Back to list

CVE-2014-1615

Status: ModifiedMedium (6.8)—

Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Carbonblack — Carbon Black

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2014-1615",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-04-22T14:23:35.283",
  "references": [
    {
      "url": "http://secunia.com/advisories/57645",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/57645",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de CSRF en Carbon Black anterior a 4.1.0 permiten a atacantes remotos secuestrar la autenticación de administradores para solicitudes que añaden usuarios administrativos nuevos y tener otra acción no especificada, tal y como fue demostrado por una solicitud hacia api/user."
    }
  ],
  "lastModified": "2026-06-17T00:05:17.620",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:carbonblack:carbon_black:*:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90E2E7E6-BA01-4C60-9E8D-B7B6B17C399B",
              "versionEndIncluding": "4.1.0"
            },
            {
              "criteria": "cpe:2.3:a:carbonblack:carbon_black:4.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1673B83-5DCC-4C5E-BE19-0C1814A16EA2"
            },
            {
              "criteria": "cpe:2.3:a:carbonblack:carbon_black:4.1.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A4F72AF-221D-40D4-805C-72A3D90445B5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}