CVE-2014-1615
Carbon Black < 4.1.0 - Cross-Site Request Forgery via API User Endpoint
Title source: llmDescription
Multiple cross-site request forgery (CSRF) vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user.
References (2)
Core 2
Core References
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/57645
Exploit x_refsource_misc
http://www.secureworks.com/advisories/SWRX-2014-007/SWRX-2014-007.pdf
Scores
EPSS
0.0061
EPSS Percentile
45.1%
Details
CWE
CWE-352
Status
published
Products (3)
carbonblack/carbon_black
4.0.3
carbonblack/carbon_black
4.1.0 beta1
carbonblack/carbon_black
< 4.1.0
Published
Apr 22, 2014
Tracked Since
Feb 18, 2026