CVE-2018-0365 — Cross-Site Request Forgery in Cisco AMP 7150 Firmware

CWE-352 — Cross-Site Request Forgery4 documents4 sources

Severity

8.8HIGHNVD

EPSS

0.2%

top 58.85%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco AMP 7150 Firmware Cisco AMP 8150 Firmware Cisco Firepower Appliance 7010 Firmware +29 more

Timeline

PublishedJun 21

Latest updateMay 13

Description

A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit c…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages32 packages

▶NVDcisco/firepower_management_center_1000_firmware6 versions+5

▶NVDcisco/firepower_management_center_2000_firmware6 versions+5

▶NVDcisco/firepower_management_center_2500_firmware6 versions+5

▶NVDcisco/firepower_management_center_4000_firmware6 versions+5

▶NVDcisco/firepower_management_center_4500_firmware6 versions+5

🔴Vulnerability Details

GHSA

GHSA-hcc8-28g7-82jh: A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct↗2022-05-13

▶

CVEList

CVE-2018-0365: A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct↗2018-06-21

▶

📋Vendor Advisories

Cisco

Cisco Firepower Management Center Cross-Site Request Forgery Vulnerability↗2018-06-20

▶