cnvd - cnvd-2018-23879

CNVD-2018-23879

Vulnerability from cnvd - Published: 2018-11-14

Title

Micro Focus Universal Configuration Management Database Browser跨站请求伪造漏洞

Description

Micro Focus Universal Configuration Management Database（UCMDB）是英国Micro Focus公司的一套可存储、控制并管理软件和基础设施的组件及其相互关系的数据库软件。UCMDB Browser是其中的一个用于访问UCMDB数据的浏览器。 Micro Focus UCMBD Browser中存在跨站请求伪造漏洞。远程攻击者可利用该漏洞实施Java对象反序列化攻击并执行未授权的操作。

Severity

中

Patch Name

Micro Focus Universal Configuration Management Database Browser跨站请求伪造漏洞的补丁

Patch Description

Formal description

厂商已发布漏洞修复程序，请及时关注更新： https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180066

Reference

https://securitytracker.com/id/1041139 https://www.securityfocus.com/bid/104483

Impacted products

Name
['Micro Focus UCMDB Browser 4.10', 'Micro Focus UCMDB Browser 4.11', 'Micro Focus UCMDB Browser 4.12', 'Micro Focus UCMDB Browser 4.13', 'Micro Focus UCMDB Browser 4.14', 'Micro Focus UCMDB Browser 4.15.1', 'Micro Focus UCMDB Browser 4.15']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "104483"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-6496"
    }
  },
  "description": "Micro Focus Universal Configuration Management Database\uff08UCMDB\uff09\u662f\u82f1\u56fdMicro Focus\u516c\u53f8\u7684\u4e00\u5957\u53ef\u5b58\u50a8\u3001\u63a7\u5236\u5e76\u7ba1\u7406\u8f6f\u4ef6\u548c\u57fa\u7840\u8bbe\u65bd\u7684\u7ec4\u4ef6\u53ca\u5176\u76f8\u4e92\u5173\u7cfb\u7684\u6570\u636e\u5e93\u8f6f\u4ef6\u3002UCMDB Browser\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7528\u4e8e\u8bbf\u95eeUCMDB\u6570\u636e\u7684\u6d4f\u89c8\u5668\u3002\n\nMicro Focus UCMBD Browser\u4e2d\u5b58\u5728\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5b9e\u65bdJava\u5bf9\u8c61\u53cd\u5e8f\u5217\u5316\u653b\u51fb\u5e76\u6267\u884c\u672a\u6388\u6743\u7684\u64cd\u4f5c\u3002",
  "discovererName": "Mateusz Garncarek",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180066",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-23879",
  "openTime": "2018-11-14",
  "patchDescription": "Micro Focus Universal Configuration Management Database\uff08UCMDB\uff09\u662f\u82f1\u56fdMicro Focus\u516c\u53f8\u7684\u4e00\u5957\u53ef\u5b58\u50a8\u3001\u63a7\u5236\u5e76\u7ba1\u7406\u8f6f\u4ef6\u548c\u57fa\u7840\u8bbe\u65bd\u7684\u7ec4\u4ef6\u53ca\u5176\u76f8\u4e92\u5173\u7cfb\u7684\u6570\u636e\u5e93\u8f6f\u4ef6\u3002UCMDB Browser\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7528\u4e8e\u8bbf\u95eeUCMDB\u6570\u636e\u7684\u6d4f\u89c8\u5668\u3002\r\n\r\nMicro Focus UCMBD Browser\u4e2d\u5b58\u5728\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5b9e\u65bdJava\u5bf9\u8c61\u53cd\u5e8f\u5217\u5316\u653b\u51fb\u5e76\u6267\u884c\u672a\u6388\u6743\u7684\u64cd\u4f5c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Micro Focus Universal Configuration Management Database Browser\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Micro Focus UCMDB Browser  4.10",
      "Micro Focus UCMDB Browser  4.11",
      "Micro Focus UCMDB Browser  4.12",
      "Micro Focus UCMDB Browser  4.13",
      "Micro Focus UCMDB Browser  4.14",
      "Micro Focus UCMDB Browser  4.15.1",
      "Micro Focus UCMDB Browser  4.15"
    ]
  },
  "referenceLink": "https://securitytracker.com/id/1041139\r\nhttps://www.securityfocus.com/bid/104483",
  "serverity": "\u4e2d",
  "submitTime": "2018-06-19",
  "title": "Micro Focus Universal Configuration Management Database Browser\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e"
}

CVE-2018-6496 (GCVE-0-2018-6496)

Vulnerability from cvelistv5 – Published: 2018-06-15 21:00 – Updated: 2024-08-05 06:01

Title

MFSBGN03809 rev.1 - Universal CMDB, Deserialization Java Objects and CSRF

Summary

Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow for remote unsafe deserialization and cross-site request forgery (CSRF).

Severity ?

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

cross-site request forgery (CSRF)

Assigner

microfocus

References

URL

Tags

	http://www.securityfocus.com/bid/104483	vdb-entryx_refsource_BID
	http://www.securitytracker.com/id/1041139	vdb-entryx_refsource_SECTRACK
	https://softwaresupport.softwaregrp.com/document/…	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Micro Focus	UCMDB Browser	Affected: 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1

Credits

Micro Focus would like to thank Mateusz Garncarek for reporting this issue to cyber-psrt@microfocus.com.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:01:49.082Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "104483",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104483"
          },
          {
            "name": "1041139",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041139"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180066"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "UCMDB Browser",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Micro Focus would like to thank Mateusz Garncarek for reporting this issue to cyber-psrt@microfocus.com."
        }
      ],
      "datePublic": "2018-06-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow for remote unsafe deserialization and cross-site request forgery (CSRF)."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "cross-site request forgery (CSRF)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "cross-site request forgery (CSRF)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-06T16:15:33",
        "orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
        "shortName": "microfocus"
      },
      "references": [
        {
          "name": "104483",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104483"
        },
        {
          "name": "1041139",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041139"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180066"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MFSBGN03809 rev.1 - Universal CMDB, Deserialization Java Objects and CSRF",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@microfocus.com",
          "ID": "CVE-2018-6496",
          "STATE": "PUBLIC",
          "TITLE": "MFSBGN03809 rev.1 - Universal CMDB, Deserialization Java Objects and CSRF"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "UCMDB Browser",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Micro Focus"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Micro Focus would like to thank Mateusz Garncarek for reporting this issue to cyber-psrt@microfocus.com."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow for remote unsafe deserialization and cross-site request forgery (CSRF)."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "cross-site request forgery (CSRF)"
          }
        ],
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "cross-site request forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "104483",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104483"
            },
            {
              "name": "1041139",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041139"
            },
            {
              "name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180066",
              "refsource": "CONFIRM",
              "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180066"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
    "assignerShortName": "microfocus",
    "cveId": "CVE-2018-6496",
    "datePublished": "2018-06-15T21:00:00",
    "dateReserved": "2018-02-01T00:00:00",
    "dateUpdated": "2024-08-05T06:01:49.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-23879

CVE-2018-6496 (GCVE-0-2018-6496)

Tags

Sightings

Nomenclature