CVE-2014-1615: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1615?
CVE-2014-1615 is classified as a high severity vulnerability due to its ability to allow remote attackers to hijack administrator authentication.
How do I fix CVE-2014-1615?
To mitigate CVE-2014-1615, you should upgrade to Carbon Black version 4.1.0 or later, as well as follow best practices for CSRF protection.
What types of attacks can be executed through CVE-2014-1615?
CVE-2014-1615 allows attackers to execute cross-site request forgery attacks that can add new administrative users without authorization.
Which versions of Carbon Black are affected by CVE-2014-1615?
CVE-2014-1615 affects Carbon Black versions prior to 4.1.0 including beta versions of 4.1.0 and 4.0.3.
Is there a patch available for CVE-2014-1615?
Yes, a patch is available by upgrading to Carbon Black version 4.1.0 or later, which resolves the vulnerability.