CVE-2016-6468
published 2016-12-14CVE-2016-6468: A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site…
PriorityP345high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
1.17%
63.9th percentile
A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. More Information: CSCvb06663. Known Affected Releases: 11.5(1.10000.4). Known Fixed Releases: 12.0(0.98000.14).
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | emergency_responder | — | — |
| cisco | emergency_responder | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_cisco4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Emergency Responder Cross-Site Request Forgery Vulnerability
vendor_cisco·2016-12-07·CVSS 4.3
CVE-2016-6468 [MEDIUM] CWE-352 Cisco Emergency Responder Cross-Site Request Forgery Vulnerability
Cisco Emergency Responder Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.
The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user.
More information about CSRF is in Understanding Cross-Site Request Forgery Threat Vectors.
There are no workaro
Cisco
Cisco Emergency Responder Cross-Site Request Forgery Vulnerability
vendor_cisco
CVE-2016-6468 Cisco Emergency Responder Cross-Site Request Forgery Vulnerability
CVE-2016-6468: Cisco Emergency Responder Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. More information about CSRF is in Understanding Cross-Site Request Forgery Threat Vectors . There ar
GHSA
GHSA-r234-5c7f-3prg: A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-
ghsa_unreviewed·2022-05-17
CVE-2016-6468 [HIGH] CWE-352 GHSA-r234-5c7f-3prg: A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-
A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. More Information: CSCvb06663. Known Affected Releases: 11.5(1.10000.4). Known Fixed Releases: 12.0(0.98000.14).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/94786http://www.securitytracker.com/id/1037428https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-cerhttp://www.securityfocus.com/bid/94786http://www.securitytracker.com/id/1037428https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-cer
2016-12-14
Published