NVD Vulnerability Detail

CVE-2017-14956

Summary	AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/ossim/report/wizard_email.php" script. Besides offering an export via a local download, the script also offers the possibility to send out any report via email to a given address (either in PDF or XLS format). Since there is no anti-CSRF token protecting this functionality, it is vulnerable to Cross-Site Request Forgery attacks.
Publication Date	Oct. 19, 2017, 3:29 a.m.
Registration Date	Jan. 26, 2021, 1:16 p.m.
Last Update	Nov. 21, 2024, 12:13 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:alienvault:unified_security_management::::::::			5.4.2

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/144617/AlienVault-USM-5.4.2-Cross-Site-Request-Forgery.html	Exploit Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/144617/AlienVault-USM-5.4.2-Cross-Site-Request-Forgery.html	Exploit Third Party Advisory VDB Entry
3	http://seclists.org/fulldisclosure/2017/Oct/32	Exploit Mailing List Third Party Advisory
4	http://seclists.org/fulldisclosure/2017/Oct/32	Exploit Mailing List Third Party Advisory
5	http://www.securityfocus.com/archive/1/541342/100/0/threaded	Third Party Advisory VDB Entry
6	http://www.securityfocus.com/archive/1/541342/100/0/threaded	Third Party Advisory VDB Entry
7	http://www.securityfocus.com/bid/101284	Third Party Advisory VDB Entry
8	http://www.securityfocus.com/bid/101284	Third Party Advisory VDB Entry
9	https://www.exploit-db.com/exploits/42988/	Exploit Third Party Advisory VDB Entry
10	https://www.exploit-db.com/exploits/42988/	Exploit Third Party Advisory VDB Entry
11	https://www.rcesecurity.com/2017/10/cve-2017-14956-alienvault-usm-leaks-sensitive-compliance-information-via-csrf/	Exploit Third Party Advisory
12	https://www.rcesecurity.com/2017/10/cve-2017-14956-alienvault-usm-leaks-sensitive-compliance-information-via-csrf/	Exploit Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-352	クロスサイト・リクエスト・フォージェリ（CSRF）	https://cwe.mitre.org/data/definitions/352.html
2	CWE-352	同一生成元ポリシー違反	https://cwe.mitre.org/data/definitions/346.html

JVN Vulnerability Information

AlienVault USM におけるクロスサイトリクエストフォージェリの脆弱性

Title	AlienVault USM におけるクロスサイトリクエストフォージェリの脆弱性
Summary	AlienVault USM には、クロスサイトリクエストフォージェリの脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Oct. 13, 2017, midnight
Registration Date	Nov. 14, 2017, 11:21 a.m.
Last Update	Nov. 14, 2017, 11:21 a.m.

Affected System

AlienVault

Unified Security Management 5.4.2 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-14956	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14956
National Vulnerability Database (NVD)
2	CVE-2017-14956	https://nvd.nist.gov/vuln/detail/CVE-2017-14956

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-352	https://jvndb.jvn.jp/ja/cwe/CWE-352.html

ベンダー情報

No	Name	URL
AlienVault
1	Top Page	https://www.alienvault.com/

その他

No	Name	URL
関連文書
1	AlienVault USM 5.4.2 Cross Site Request Forgery	https://packetstormsecurity.com/files/144617/AlienVault-USM-5.4.2-Cross-Site-Request-Forgery.html

Change Log

No	Changed Details	Date of change
0	[2017年11月14日] 掲載	Feb. 17, 2018, 10:37 a.m.