Cisco Security Manager CVE-2014-3267 Cross Site Request Forgery Vulnerability

Bugtraq ID:	67550
Class:	Input Validation Error
CVE:	CVE-2014-3267
Remote:	Yes
Local:	No
Published:	May 21 2014 12:00AM
Updated:	Jul 22 2014 06:19AM
Credit:	Cisco
Vulnerable:
Not Vulnerable:

Cisco Security Manager CVE-2014-3267 Cross Site Request Forgery Vulnerability

Cisco Security Manager is prone to a cross-site request-forgery vulnerability because the application does not properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected user. Other attacks are also possible.

This issue is being tracked by Cisco bug IDs CSCuo46427 and CSCup26931.

Cisco Security Manager CVE-2014-3267 Cross Site Request Forgery Vulnerability

To exploit the issue an attacker must entice a user into visiting a malicious site.

Cisco Security Manager CVE-2014-3267 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco Security Manager CVE-2014-3267 Cross Site Request Forgery Vulnerability

References:

• Cisco Homepage (Cisco )