VulnerabilityModified

CVE-2014-2989

Cross-site request forgery (CSRF) vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a request to Users/add.

MEDIUM 6.8EPSS 1.20%

Does this matter?

Lower severity and a low EPSS score (1.20%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS: 1.20% probability · 66th percentile
CISA KEV: Not listed
Weakness: CWE-352
Affected: open assessment technologies /tao
Source: cve@mitre.org

References

http://secunia.com/advisories/58539Vendor Advisory
http://www.securityfocus.com/bid/67291
https://www.htbridge.com/advisory/HTB23211Exploit
http://secunia.com/advisories/58539Vendor Advisory
http://www.securityfocus.com/bid/67291
https://www.htbridge.com/advisory/HTB23211Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.