CVE-2014-0336

Published Mar 6, 2014

Last updated 3 months ago

Overview

Description: Cross-site request forgery (CSRF) vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the user_new_master parameter to the adminconsole/ URI.
Source: cret@cert.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.8
Impact score: 6.4
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-352

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:serena:dimensions_cm:12.2:build7.199.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E7A337C9-5AE9-4592-9B08-CCC6C7495E62"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References