Cisco Unified Computing System CVE-2014-7996 Cross Site Request Forgery Vulnerability

Bugtraq ID:	71171
Class:	Input Validation Error
CVE:	CVE-2014-7996
Remote:	Yes
Local:	No
Published:	Nov 18 2014 12:00AM
Updated:	Nov 18 2014 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Unified Computing System (UCS) 0
Not Vulnerable:

Cisco Unified Computing System CVE-2014-7996 Cross Site Request Forgery Vulnerability

Cisco Unified Computing System is prone to a cross-site request-forgery vulnerability because the application does not properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected user. Other attacks are also possible.

This issue is being tracked by Cisco bug ID CSCuq45477.

Cisco Unified Computing System CVE-2014-7996 Cross Site Request Forgery Vulnerability

To exploit the issue an attacker must entice a user into visiting a malicious site.

Cisco Unified Computing System CVE-2014-7996 Cross Site Request Forgery Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cisco Unified Computing System CVE-2014-7996 Cross Site Request Forgery Vulnerability

References:

• Cisco Homepage (Cisco )