CVE-2014-2115
published 2014-04-04CVE-2014-2115: Multiple cross-site request forgery (CSRF) vulnerabilities in CERUserServlet pages in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to…
PriorityP427medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
0.65%
47.1th percentile
Multiple cross-site request forgery (CSRF) vulnerabilities in CERUserServlet pages in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun24250.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | emergency_responder | <= 8.6 | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_cisco6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Emergency Responder Cross-Site Request Forgery Vulnerability
vendor_cisco·2014-04-03·CVSS 6.8
CVE-2014-2115 [MEDIUM] CWE-352 Cisco Emergency Responder Cross-Site Request Forgery Vulnerability
Cisco Emergency Responder Cross-Site Request Forgery Vulnerability
A vulnerability in the CERUserServlet pages of the Cisco Emergency Responder (Cisco ER) could allow an unauthenticated, remote attacker to perform a cross-site request forgery (CSRF) attack against the Cisco ER web interface.
The vulnerability is due to insufficient CSRF protections on the Cisco ER web interface. An attacker could exploit this vulnerability by persuading an authenticated user of the affected system to follow a malicious link or visit an attacker-controlled website. A successful exploit could allow the attacker to make changes to Cisco ER on behalf of the user.
Cisco has confirmed the vulnerability in a security notice; however, software updates are not available.
To exploit the vulnerability, the attac
GHSA
GHSA-3p4p-9w8x-v77p: Multiple cross-site request forgery (CSRF) vulnerabilities in CERUserServlet pages in Cisco Emergency Responder (ER) 8
ghsa_unreviewed·2022-05-17
CVE-2014-2115 [MEDIUM] CWE-352 GHSA-3p4p-9w8x-v77p: Multiple cross-site request forgery (CSRF) vulnerabilities in CERUserServlet pages in Cisco Emergency Responder (ER) 8
Multiple cross-site request forgery (CSRF) vulnerabilities in CERUserServlet pages in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun24250.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2115http://tools.cisco.com/security/center/viewAlert.x?alertId=33643http://www.securityfocus.com/bid/66631http://www.securitytracker.com/id/1030019http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2115http://tools.cisco.com/security/center/viewAlert.x?alertId=33643http://www.securityfocus.com/bid/66631http://www.securitytracker.com/id/1030019
2014-04-04
Published