ByteOS Network

NVD Vulnerability Details :

CVE-2017-14956

Deferred

Source-cve@mitre.org

Published At-18 Oct, 2017 | 18:29

Updated At-20 Apr, 2025 | 01:37

AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/ossim/report/wizard_email.php" script. Besides offering an export via a local download, the script also offers the possibility to send out any report via email to a given address (either in PDF or XLS format). Since there is no anti-CSRF token protecting this functionality, it is vulnerable to Cross-Site Request Forgery attacks.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	5.7	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Primary	2.0	3.5	LOW	AV:N/AC:M/Au:S/C:P/I:N/A:N

CPE Matches

alienvault>>unified_security_management>>Versions up to 5.4.2(inclusive)

cpe:2.3:a:alienvault:unified_security_management:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-352	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/144617/AlienVault-USM-5.4.2-Cross-Site-Request-Forgery.html	cve@mitre.org	Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2017/Oct/32	cve@mitre.org	Exploit Mailing List Third Party Advisory
http://www.securityfocus.com/archive/1/541342/100/0/threaded	cve@mitre.org	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/101284	cve@mitre.org	Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/42988/	cve@mitre.org	Exploit Third Party Advisory VDB Entry
https://www.rcesecurity.com/2017/10/cve-2017-14956-alienvault-usm-leaks-sensitive-compliance-information-via-csrf/	cve@mitre.org	Exploit Third Party Advisory
http://packetstormsecurity.com/files/144617/AlienVault-USM-5.4.2-Cross-Site-Request-Forgery.html	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2017/Oct/32	af854a3a-2127-422b-91ae-364da2661108	Exploit Mailing List Third Party Advisory
http://www.securityfocus.com/archive/1/541342/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/101284	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/42988/	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory VDB Entry
https://www.rcesecurity.com/2017/10/cve-2017-14956-alienvault-usm-leaks-sensitive-compliance-information-via-csrf/	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History