CVE-2024-11014 — Cross-Site Request Forgery in Corporation Univerge IX

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.0%
top 90.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
NEC Corporation Univerge IX
Timeline
PublishedNov 29

Description

Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27 and for Ver10.9 up to Ver10.9.14 allows a attacker to hijack the authentication of screens on the device via the management interface.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

▶CVEListV5nec_corporation/univerge_ixfor Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14, from Ver9.2 to Ver10.10.21+2

🔴Vulnerability Details

2
GHSA
GHSA-xhf4-qqf8-2pw6: Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9↗2024-11-29
▶
CVEList
CVE-2024-11014: Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9↗2024-11-29
▶
CVE-2024-11014 — Cross-Site Request Forgery | cvebase