cnvd - cnvd-2018-23879

cnvd-2018-23879

Vulnerability from cnvd

Title: Micro Focus Universal Configuration Management Database Browser跨站请求伪造漏洞

Description:

Micro Focus Universal Configuration Management Database（UCMDB）是英国Micro Focus公司的一套可存储、控制并管理软件和基础设施的组件及其相互关系的数据库软件。UCMDB Browser是其中的一个用于访问UCMDB数据的浏览器。

Micro Focus UCMBD Browser中存在跨站请求伪造漏洞。远程攻击者可利用该漏洞实施Java对象反序列化攻击并执行未授权的操作。

Severity: 中

Patch Name: Micro Focus Universal Configuration Management Database Browser跨站请求伪造漏洞的补丁

Patch Description:

Micro Focus UCMBD Browser中存在跨站请求伪造漏洞。远程攻击者可利用该漏洞实施Java对象反序列化攻击并执行未授权的操作。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布漏洞修复程序，请及时关注更新： https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180066

Reference: https://securitytracker.com/id/1041139 https://www.securityfocus.com/bid/104483

Impacted products

Name
['Micro Focus UCMDB Browser 4.10', 'Micro Focus UCMDB Browser 4.11', 'Micro Focus UCMDB Browser 4.12', 'Micro Focus UCMDB Browser 4.13', 'Micro Focus UCMDB Browser 4.14', 'Micro Focus UCMDB Browser 4.15.1', 'Micro Focus UCMDB Browser 4.15']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "104483"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-6496"
    }
  },
  "description": "Micro Focus Universal Configuration Management Database\uff08UCMDB\uff09\u662f\u82f1\u56fdMicro Focus\u516c\u53f8\u7684\u4e00\u5957\u53ef\u5b58\u50a8\u3001\u63a7\u5236\u5e76\u7ba1\u7406\u8f6f\u4ef6\u548c\u57fa\u7840\u8bbe\u65bd\u7684\u7ec4\u4ef6\u53ca\u5176\u76f8\u4e92\u5173\u7cfb\u7684\u6570\u636e\u5e93\u8f6f\u4ef6\u3002UCMDB Browser\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7528\u4e8e\u8bbf\u95eeUCMDB\u6570\u636e\u7684\u6d4f\u89c8\u5668\u3002\n\nMicro Focus UCMBD Browser\u4e2d\u5b58\u5728\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5b9e\u65bdJava\u5bf9\u8c61\u53cd\u5e8f\u5217\u5316\u653b\u51fb\u5e76\u6267\u884c\u672a\u6388\u6743\u7684\u64cd\u4f5c\u3002",
  "discovererName": "Mateusz Garncarek",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180066",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-23879",
  "openTime": "2018-11-14",
  "patchDescription": "Micro Focus Universal Configuration Management Database\uff08UCMDB\uff09\u662f\u82f1\u56fdMicro Focus\u516c\u53f8\u7684\u4e00\u5957\u53ef\u5b58\u50a8\u3001\u63a7\u5236\u5e76\u7ba1\u7406\u8f6f\u4ef6\u548c\u57fa\u7840\u8bbe\u65bd\u7684\u7ec4\u4ef6\u53ca\u5176\u76f8\u4e92\u5173\u7cfb\u7684\u6570\u636e\u5e93\u8f6f\u4ef6\u3002UCMDB Browser\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7528\u4e8e\u8bbf\u95eeUCMDB\u6570\u636e\u7684\u6d4f\u89c8\u5668\u3002\r\n\r\nMicro Focus UCMBD Browser\u4e2d\u5b58\u5728\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5b9e\u65bdJava\u5bf9\u8c61\u53cd\u5e8f\u5217\u5316\u653b\u51fb\u5e76\u6267\u884c\u672a\u6388\u6743\u7684\u64cd\u4f5c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Micro Focus Universal Configuration Management Database Browser\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Micro Focus UCMDB Browser  4.10",
      "Micro Focus UCMDB Browser  4.11",
      "Micro Focus UCMDB Browser  4.12",
      "Micro Focus UCMDB Browser  4.13",
      "Micro Focus UCMDB Browser  4.14",
      "Micro Focus UCMDB Browser  4.15.1",
      "Micro Focus UCMDB Browser  4.15"
    ]
  },
  "referenceLink": "https://securitytracker.com/id/1041139\r\nhttps://www.securityfocus.com/bid/104483",
  "serverity": "\u4e2d",
  "submitTime": "2018-06-19",
  "title": "Micro Focus Universal Configuration Management Database Browser\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e"
}

CVE-2018-6496 (GCVE-0-2018-6496)

Vulnerability from cvelistv5

Published

2018-06-15 21:00

Modified

2024-08-05 06:01

Severity ?

7.5 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

cross-site request forgery (CSRF)

Summary

Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow for remote unsafe deserialization and cross-site request forgery (CSRF).

References

▼	URL	Tags
	http://www.securityfocus.com/bid/104483	vdb-entry, x_refsource_BID
	http://www.securitytracker.com/id/1041139	vdb-entry, x_refsource_SECTRACK
	https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180066	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Micro Focus	UCMDB Browser	Version: 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:01:49.082Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "104483",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104483"
          },
          {
            "name": "1041139",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041139"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180066"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "UCMDB Browser",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Micro Focus would like to thank Mateusz Garncarek for reporting this issue to cyber-psrt@microfocus.com."
        }
      ],
      "datePublic": "2018-06-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow for remote unsafe deserialization and cross-site request forgery (CSRF)."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "cross-site request forgery (CSRF)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "cross-site request forgery (CSRF)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-06T16:15:33",
        "orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
        "shortName": "microfocus"
      },
      "references": [
        {
          "name": "104483",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104483"
        },
        {
          "name": "1041139",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041139"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180066"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MFSBGN03809 rev.1 - Universal CMDB, Deserialization Java Objects and CSRF",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@microfocus.com",
          "ID": "CVE-2018-6496",
          "STATE": "PUBLIC",
          "TITLE": "MFSBGN03809 rev.1 - Universal CMDB, Deserialization Java Objects and CSRF"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "UCMDB Browser",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Micro Focus"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Micro Focus would like to thank Mateusz Garncarek for reporting this issue to cyber-psrt@microfocus.com."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow for remote unsafe deserialization and cross-site request forgery (CSRF)."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "cross-site request forgery (CSRF)"
          }
        ],
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "cross-site request forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "104483",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104483"
            },
            {
              "name": "1041139",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041139"
            },
            {
              "name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180066",
              "refsource": "CONFIRM",
              "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180066"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
    "assignerShortName": "microfocus",
    "cveId": "CVE-2018-6496",
    "datePublished": "2018-06-15T21:00:00",
    "dateReserved": "2018-02-01T00:00:00",
    "dateUpdated": "2024-08-05T06:01:49.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted