Unscored severity · published May 26, 2014
CVE-2014-3267
Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to hijack the authentication of arbitrary…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make unspecified changes, aka Bug ID CSCuo46427.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Security Manager · Cisco
through 4.6; 4.0; 4.0; 4.0.1; 4.0.1; 4.0.1; +12 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3267
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3267
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3267
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=34325
Third Party Advisory
http://www.securitytracker.com/id/1030271
More from Security Manager
9.8
CVE-2020-27131
Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands…
9.8
CVE-2020-27125
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system
9.8
CVE-2019-12630
A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected…
9.1
CVE-2020-27130
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information
9.1
CVE-2019-1903
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition