6.5
CVE-2018-8892
- EPSS 0.41%
- Veröffentlicht 20.12.2018 20:29:00
- Zuletzt bearbeitet 21.11.2024 04:14:32
- Quelle secure@blackberry.com
- CVE-Watchlists
- Unerledigt
LoginA cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to make modifications to the UEM settings in the context of a Management Console administrator.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Blackberry ≫ Unified Endpoint Manager Version < 12.9.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.41% | 0.322 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
http://support.blackberry.com/kb/articleDetail?articleNumber=000054162