CVE-2014-5361

Multiple cross-site request forgery (CSRF) vulnerabilities in Landesk Management Suite 9.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) start, (2) stop, or (3) restart services via a request to remote/serverServices.aspx.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://packetstormsecurity.com/files/131496/Landesk-Management-Suite-9.5-RFI-CSRF.html	Exploit
http://www.securityfocus.com/archive/1/535286/100/0/threaded

Configurations

Configuration 1 (hide)

cpe:2.3:a:landesk:landesk_management_suite:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2015-04-21 15:59

Updated : 2024-02-04 18:35

NVD link : CVE-2014-5361

Mitre link : CVE-2014-5361

CVE.ORG link : CVE-2014-5361

JSON object : View

Products Affected

landesk

landesk_management_suite

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2014-5361", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-04-21T15:59:00.090", "references": [{"url": "http://packetstormsecurity.com/files/131496/Landesk-Management-Suite-9.5-RFI-CSRF.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/535286/100/0/threaded", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Landesk Management Suite 9.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) start, (2) stop, or (3) restart services via a request to remote/serverServices.aspx."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de CSRF en Landesk Management Suite 9.6 y anteriores permiten a atacantes remotos secuestrar la autenticaci\u00f3n de administradores para solicitudes que (1) inician, (2) paran o (3) reinician a trav\u00e9s de una solicitud a remote/serverServices.aspx."}], "lastModified": "2018-10-09T19:50:09.240", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:landesk:landesk_management_suite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "974DF68F-3957-421C-A82B-557A47A03B60", "versionEndIncluding": "9.6"}], "operator": "OR"}]}], "vendorComments": [{"comment": "The vulnerability described in CVE-2014-5361 was fixed in Landesk Management Suit (LDMS) version: 9.5 SP3, 9.6 SP1, 10.0.\nLDMS Customers are encouraged to upgrade to the listed versions or newer\n", "lastModified": "2016-04-07T09:37:59.197", "organization": "LANDESK"}], "sourceIdentifier": "cve@mitre.org"}