CVE-2014-6125 — Cross-Site Request Forgery in IBM Websphere Portal

CWE-352 — Cross-Site Request ForgeryCWE-172 — Encoding ErrorCWE-697 — Incorrect ComparisonCWE-295 — Improper Certificate Validation6 documents5 sources
Severity
6.8MEDIUMNVD
EPSS
0.2%
top 62.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Websphere Portal
Timeline
PublishedOct 28
Latest updateMay 17

Description

Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Portal 8.5.0 before CF03 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages1 packages

Patches

Patch: www-01.ibm.com ↗Patch: www-01.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-87f7-rq2h-978j: Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Portal 8↗2022-05-17
▶
CVEList
CVE-2014-6125: Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Portal 8↗2014-10-28
▶

📋Vendor Advisories

1
Red Hat
nss: IDNA hostname matching code does not follow RFC 6125 recommendation (MFSA 2014-45)↗2014-03-18
▶

💬Community

1
Bugzilla
CVE-2015-1855 ruby: OpenSSL extension hostname matching implementation violates RFC 6125↗2015-04-08
▶
CVE-2014-6125 — Cross-Site Request Forgery in IBM | cvebase