CVE の説明
Fox-IT DataDiode Appliance CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative web interface in the proxy server on Fox-IT Fox DataDiode appliances before 1.7.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create administrative users, (2) remove administrative users, or (3) change permissions.CVE の解決策
Fox-IT has released Version 1.7.2 of the Fox DataDiode Appliance that
resolves the reported vulnerability. A Fox-IT product advisory titled
“Fox DataDiode Appliance 1.7.2 advisory,” containing background and
preparation information, as well as the upgrade instructions, are
available by contacting the local Fox-IT customer support.
Fox-IT also recommends the following actions:
* All users of the Fox DataDiode Appliance should upgrade their systems to Version 1.7.2.
* This installation consists of a reinstallation of the new version of
the software. Therefore, the existing software configuration should be
exported before this upgrade. This configuration can then be restored
after the upgrade.
* Users are advised to change all passwords of administrator and user
accounts in the Fox DataDiode Appliance, plus passwords used for FTP/SSL
connections.
CVE の情報
関連する弱点
| 弱点名 | 出典 | |
|---|---|---|
| Cross-Site Request Forgery The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
メトリクス
| メトリクス | スコア | 深刻度 | CVSS ベクター | 出典 |
|---|---|---|---|---|
| V2 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P | ||
| V2 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P | nvd@nist.gov |
EPSS
EPSSは脆弱性が悪用される可能性を予測するスコアリングモデルです。
EPSSスコア
EPSSモデルは0から1（0〜100%）の確率スコアを算出します。スコアが高いほど、脆弱性が悪用される可能性が高いことを示します。
EPSSパーセンタイル
パーセンタイルはCVEをEPSSスコアで順位付けするために使用されます。例えば、EPSSスコアで95パーセンタイルにあるCVEは、他の95%のCVEよりも悪用される可能性が高いことを意味します。パーセンタイルはCVEのEPSSスコアを他のCVEと比較するために使用されます。
関連製品
構成 0
Fox-it>>Fox_datadiode >> Version ～まで（含む） 1.7.1
参考資料
https://ics-cert.us-cert.gov/advisories/ICSA-14-269-02
Tags : Third Party Advisory, US Government Resource
Tags : Third Party Advisory, US Government Resource
