CVE-2018-6504 — Cross-Site Request Forgery in Arcsight Management Center

CWE-352 — Cross-Site Request Forgery3 documents3 sources

Severity

8.8HIGHNVD

EPSS

0.1%

top 71.27%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microfocus Arcsight Management Center Micro Focus Arcsight Management Center

Timeline

PublishedSep 20

Latest updateMay 13

Description

A potential Cross-Site Request Forgery (CSRF) vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Cross-Site Request Forgery (CSRF).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDmicrofocus/arcsight_management_center< 2.81

▶CVEListV5micro_focus/arcsight_management_centerall versions prior to 2.81

🔴Vulnerability Details

GHSA

GHSA-j3j3-gw6m-h758: A potential Cross-Site Request Forgery (CSRF) vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2↗2022-05-13

▶

CVEList

MFSBGN03824 rev.1 - ArcSight Management Center, Insufficient Access Control, Reflected Cross Site Scripting, Access Control vulnerability, Cross-Site Request Forgery (CSRF), Unauthenticated File Downl↗2018-09-20

▶