CVE-2014-1984

Session fixation vulnerability in the management screen in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to hijack web sessions via unspecified vectors.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://cs.cybozu.co.jp/information/20130317notice02.php	Patch Vendor Advisory
http://jvn.jp/en/jp/JVN00058727/index.html	Third Party Advisory VDB Entry
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000040	Third Party Advisory VDB Entry
http://cs.cybozu.co.jp/information/20130317notice02.php	Patch Vendor Advisory
http://jvn.jp/en/jp/JVN00058727/index.html	Third Party Advisory VDB Entry
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000040	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cybozu:remote_service_manager::::::::
	cpe:2.3:a:cybozu:remote_service_manager::::::::

History

21 Nov 2024, 02:05

Type	Values Removed	Values Added
References	~~() http://cs.cybozu.co.jp/information/20130317notice02.php - Patch, Vendor Advisory~~	() http://cs.cybozu.co.jp/information/20130317notice02.php - Patch, Vendor Advisory
References	~~() http://jvn.jp/en/jp/JVN00058727/index.html - Third Party Advisory, VDB Entry~~	() http://jvn.jp/en/jp/JVN00058727/index.html - Third Party Advisory, VDB Entry
References	~~() http://jvndb.jvn.jp/jvndb/JVNDB-2014-000040 - Third Party Advisory, VDB Entry~~	() http://jvndb.jvn.jp/jvndb/JVNDB-2014-000040 - Third Party Advisory, VDB Entry

Information

Published : 2014-04-19 19:55

Updated : 2024-11-21 02:05

NVD link : CVE-2014-1984

Mitre link : CVE-2014-1984

CVE.ORG link : CVE-2014-1984

JSON object : View

Products Affected

cybozu

remote_service_manager

CWE

CWE-287

Improper Authentication

{"id": "CVE-2014-1984", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-04-19T19:55:07.687", "references": [{"url": "http://cs.cybozu.co.jp/information/20130317notice02.php", "tags": ["Patch", "Vendor Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "http://jvn.jp/en/jp/JVN00058727/index.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "vultures@jpcert.or.jp"}, {"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000040", "tags": ["Third Party Advisory", "VDB Entry"], "source": "vultures@jpcert.or.jp"}, {"url": "http://cs.cybozu.co.jp/information/20130317notice02.php", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://jvn.jp/en/jp/JVN00058727/index.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000040", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Session fixation vulnerability in the management screen in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to hijack web sessions via unspecified vectors."}, {"lang": "es", "value": "Vulnerabilidad de fijaci\u00f3n de sesi\u00f3n en la pantalla de gesti\u00f3n en Cybozu Remote Service Manager hasta 2.3.0 y 3.x anterior a 3.1.1 permite a atacantes remotos secuestrar sesiones web a trav\u00e9s de vectores no especificados."}], "lastModified": "2024-11-21T02:05:24.293", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cybozu:remote_service_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "879F89AE-5AC1-425E-AE87-574A8719ADCD", "versionEndIncluding": "2.3.0"}, {"criteria": "cpe:2.3:a:cybozu:remote_service_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5704ED7A-7356-4C9C-8235-705C8F13A258", "versionEndIncluding": "3.1.0", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}