CVE-2014-4774

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
6.8MEDIUM
EPSS
0.1%
top 71.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Endpoint Manager FamilyIBM License Metric Tool
Timeline
PublishedMay 25
Latest updateMay 17

Description

Cross-site request forgery (CSRF) vulnerability in the login page in IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 allows remote attackers to hijack the authentication of arbitrary users via vectors involving a FRAME element.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages2 packages

▶NVDibm/license_metric_tool9.0, 9.0.1, 9.1.0.1+2
▶NVDibm/endpoint_manager_family9.0.1, 9.1.0+1

🔴Vulnerability Details

2
GHSA
GHSA-652v-gjf6-q685: Cross-site request forgery (CSRF) vulnerability in the login page in IBM License Metric Tool 9 before 9↗2022-05-17
▶
CVEList
CVE-2014-4774: Cross-site request forgery (CSRF) vulnerability in the login page in IBM License Metric Tool 9 before 9↗2015-05-25
▶