{"id":"CVE-2011-4498","url":"https://www.cyber-defence.io/tools/cve/CVE-2011-4498","generatedAt":"2026-10-27T18:47:01.496Z","title":"Cross-site request forgery (CSRF) vulnerability in the web console in Zenprise Device Manager 6.x through 6.1.8 allows remote attackers to hijack the authentication of administrators for requests that wipe mobile devices.","description":"Cross-site request forgery (CSRF) vulnerability in the web console in Zenprise Device Manager 6.x through 6.1.8 allows remote attackers to hijack the authentication of administrators for requests that wipe mobile devices.","published":"2011-11-21T11:55:05.000Z","lastModified":"2026-06-16T23:34:56.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":6.8,"severity":"MEDIUM","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P"},"cwe":["CWE-352"],"affected":["zenprise/zenprise device manager"],"epss":{"score":0.00563,"percentile":0.46572,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.56%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://www.kb.cert.org/vuls/id/584363","tags":["Patch","US Government Resource"],"source":"cve@mitre.org"},{"url":"http://www.zenpriseportal.com/patches/ZP_SecPatch_618_9995.zip","tags":["Patch"],"source":"cve@mitre.org"},{"url":"http://www.kb.cert.org/vuls/id/584363","tags":["Patch","US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.zenpriseportal.com/patches/ZP_SecPatch_618_9995.zip","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-4498","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}