CVE-2013-3089

Cross-site request forgery (CSRF) vulnerability in apply.cgi in Belkin N300 (F7D7301v1) router allows remote attackers to hijack the authentication of administrators for requests that modify configuration.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://securityevaluators.com/knowledge/case_studies/routers/Vulnerability_Catalog.pdf	Exploit
http://securityevaluators.com/knowledge/case_studies/routers/belkin_n900.php	Exploit
http://securityevaluators.com/knowledge/case_studies/routers/Vulnerability_Catalog.pdf	Exploit
http://securityevaluators.com/knowledge/case_studies/routers/belkin_n900.php	Exploit

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:belkin:n300_firmware:1.00.06:*:*:*:*:*:*:*

cpe:2.3:h:belkin:n300:-:*:*:*:*:*:*:*

History

21 Nov 2024, 01:52

Type	Values Removed	Values Added
References	~~() http://securityevaluators.com/knowledge/case_studies/routers/Vulnerability_Catalog.pdf - Exploit~~	() http://securityevaluators.com/knowledge/case_studies/routers/Vulnerability_Catalog.pdf - Exploit
References	~~() http://securityevaluators.com/knowledge/case_studies/routers/belkin_n900.php - Exploit~~	() http://securityevaluators.com/knowledge/case_studies/routers/belkin_n900.php - Exploit

Information

Published : 2014-09-29 22:55

Updated : 2024-11-21 01:52

NVD link : CVE-2013-3089

Mitre link : CVE-2013-3089

CVE.ORG link : CVE-2013-3089

JSON object : View

Products Affected

belkin

n300_firmware
n300

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2013-3089", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2014-09-29T22:55:08.427", "references": [{"url": "http://securityevaluators.com/knowledge/case_studies/routers/Vulnerability_Catalog.pdf", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://securityevaluators.com/knowledge/case_studies/routers/belkin_n900.php", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://securityevaluators.com/knowledge/case_studies/routers/Vulnerability_Catalog.pdf", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securityevaluators.com/knowledge/case_studies/routers/belkin_n900.php", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in apply.cgi in Belkin N300 (F7D7301v1) router allows remote attackers to hijack the authentication of administrators for requests that modify configuration."}, {"lang": "es", "value": "Vulnerabilidad de CSRF en apply.cgi en el router Belkin N300 (F7D7301v1) permite a atacantes remotos secuestrar la autenticaci\u00f3n de administradores para solicitudes que modifican configuraciones."}], "lastModified": "2024-11-21T01:52:59.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:belkin:n300_firmware:1.00.06:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3E25236-DE44-40EC-990C-5D123C6DACD2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:belkin:n300:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B151B0B-F29D-43CB-9147-C9DAFBBA0D19"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}