{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-04-14T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-04-22T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "57645", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/57645"}, {"tags": ["x_refsource_MISC"], "url": "http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-1615", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "57645", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/57645"}, {"name": "http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf", "refsource": "MISC", "url": "http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T09:50:09.611Z"}, "title": "CVE Program Container", "references": [{"name": "57645", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/57645"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2014-1615", "datePublished": "2014-04-22T14:00:00", "dateReserved": "2014-01-20T00:00:00", "dateUpdated": "2024-08-06T09:50:09.611Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:carbonblack:carbon_black:*:beta2:*:*:*:*:*:*", "matchCriteriaId": "90E2E7E6-BA01-4C60-9E8D-B7B6B17C399B", "versionEndIncluding": "4.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:carbonblack:carbon_black:4.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "E1673B83-5DCC-4C5E-BE19-0C1814A16EA2", "vulnerable": true}, {"criteria": "cpe:2.3:a:carbonblack:carbon_black:4.1.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "5A4F72AF-221D-40D4-805C-72A3D90445B5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de CSRF en Carbon Black anterior a 4.1.0 permiten a atacantes remotos secuestrar la autenticaci\u00f3n de administradores para solicitudes que a\u00f1aden usuarios administrativos nuevos y tener otra acci\u00f3n no especificada, tal y como fue demostrado por una solicitud hacia api/user."}], "id": "CVE-2014-1615", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2014-04-22T14:23:35.283", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/57645"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/57645"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}