VulnerabilityModified
CVE-2013-7107
Cross-site request forgery (CSRF) vulnerability in cmd.cgi in Icinga 1.8.5, 1.9.4, 1.10.2, and earlier allows remote attackers to hijack the authentication of users for unspecified commands via unspecified vectors, as demonstrated by bypassing…
MEDIUM 6.8EPSS 1.01%
Does this matter?
Lower severity and a low EPSS score (1.01%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site request forgery (CSRF) vulnerability in cmd.cgi in Icinga 1.8.5, 1.9.4, 1.10.2, and earlier allows remote attackers to hijack the authentication of users for unspecified commands via unspecified vectors, as demonstrated by bypassing authentication requirements for CVE-2013-7106.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.01% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- icinga/icinga
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00061.html
- http://www.openwall.com/lists/oss-security/2013/12/16/4
- https://dev.icinga.org/issues/5250Vendor Advisory
- https://dev.icinga.org/issues/5346Vendor Advisory
- https://www.icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5/Vendor Advisory
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00061.html
- http://www.openwall.com/lists/oss-security/2013/12/16/4
- https://dev.icinga.org/issues/5250Vendor Advisory
- https://dev.icinga.org/issues/5346Vendor Advisory
- https://www.icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.