VULNERABILITY INTELLIGENCE
CVE-2017-14956
CVSS score5.7 MEDIUM
EPSS probability1.86%
CISA KEVNot currently listed
Published2017-10-18
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Description
AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/ossim/report/wizard_email.php" script. Besides offering an export via a local download, the script also offers the possibility to send out any report via email to a given address (either in PDF or XLS format). Since there is no anti-CSRF token protecting this functionality, it is vulnerable to Cross-Site Request Forgery attacks.
Weakness classification
- nvd@nist.gov: CWE-352
Primary references
- cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
- cve@mitre.org — Exploit, Mailing List, Third Party Advisory
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
- cve@mitre.org — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory