CVE-2013-6443

2014-01-2301:55:03

CWE-352

[email protected]

web.nvd.nist.gov

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

40.0%

JSON

CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.

Affected configurations

Nvd

Node

redhatcloudformsMatch3.0

redhatcloudforms_3.0_management_engineRange≤5.2.1

redhatcloudforms_3.0_management_engineMatch5.2

VendorProductVersionCPE
redhatcloudforms3.0cpe:2.3:a:redhat:cloudforms:3.0:*:*:*:*:*:*:*
redhatcloudforms_3.0_management_engine*cpe:2.3:a:redhat:cloudforms_3.0_management_engine:*:*:*:*:*:*:*:*
redhatcloudforms_3.0_management_engine5.2cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	cloudforms	3.0	cpe:2.3:a:redhat:cloudforms:3.0:::::::*
redhat	cloudforms_3.0_management_engine	*	cpe:2.3:a:redhat:cloudforms_3.0_management_engine::::::::
redhat	cloudforms_3.0_management_engine	5.2	cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2:::::::*