CVE-2016-1470 - Vulnerability Details - OpenCVE

Cross-site request forgery (CSRF) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuz76230.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cisco	Small Business 220 Series Smart Plus Switches

Configuration 1 [-]

OR	cpe:2.3:a:cisco:small_business_220_series_smart_plus_switches:1.0.0.17:::::::*
	cpe:2.3:a:cisco:small_business_220_series_smart_plus_switches:1.0.0.18:::::::*
	cpe:2.3:a:cisco:small_business_220_series_smart_plus_switches:1.0.0.19:::::::*

No data.

References

Link	Providers
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-sps
http://www.securityfocus.com/bid/92709
http://www.securitytracker.com/id/1036722
http://www.synacktiv.com/ressources/advisories_cisco_switch_sg220_csrf.pdf

History

No history.

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2016-09-02T00:00:00

Updated: 2024-08-05T22:55:14.943Z

Reserved: 2016-01-04T00:00:00

Link: CVE-2016-1470

Vulnrichment

No data.

NVD

Status : Modified

Published: 2016-09-02T00:59:00.137

Modified: 2024-11-21T02:46:30.230

Link: CVE-2016-1470

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-08-31T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuz76230."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-12T09:57:01", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco"}, "references": [{"name": "20160831 Cisco Small Business 220 Series Smart Plus Switches Web Interface Cross-Site Request Forgery Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-sps"}, {"name": "1036722", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1036722"}, {"name": "92709", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/92709"}, {"tags": ["x_refsource_MISC"], "url": "http://www.synacktiv.com/ressources/advisories_cisco_switch_sg220_csrf.pdf"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@cisco.com", "ID": "CVE-2016-1470", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site request forgery (CSRF) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuz76230."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20160831 Cisco Small Business 220 Series Smart Plus Switches Web Interface Cross-Site Request Forgery Vulnerability", "refsource": "CISCO", "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-sps"}, {"name": "1036722", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1036722"}, {"name": "92709", "refsource": "BID", "url": "http://www.securityfocus.com/bid/92709"}, {"name": "http://www.synacktiv.com/ressources/advisories_cisco_switch_sg220_csrf.pdf", "refsource": "MISC", "url": "http://www.synacktiv.com/ressources/advisories_cisco_switch_sg220_csrf.pdf"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T22:55:14.943Z"}, "title": "CVE Program Container", "references": [{"name": "20160831 Cisco Small Business 220 Series Smart Plus Switches Web Interface Cross-Site Request Forgery Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"], "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-sps"}, {"name": "1036722", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1036722"}, {"name": "92709", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/92709"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.synacktiv.com/ressources/advisories_cisco_switch_sg220_csrf.pdf"}]}]}, "cveMetadata": {"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2016-1470", "datePublished": "2016-09-02T00:00:00", "dateReserved": "2016-01-04T00:00:00", "dateUpdated": "2024-08-05T22:55:14.943Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:small_business_220_series_smart_plus_switches:1.0.0.17:*:*:*:*:*:*:*", "matchCriteriaId": "E3F433C9-9092-4620-BCF7-18EB38A8E76F", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:small_business_220_series_smart_plus_switches:1.0.0.18:*:*:*:*:*:*:*", "matchCriteriaId": "78A643B7-E2C8-47AE-BBE0-781487D73FFE", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:small_business_220_series_smart_plus_switches:1.0.0.19:*:*:*:*:*:*:*", "matchCriteriaId": "0F29DEE9-78E3-4906-8CB1-3A08EC64D24C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuz76230."}, {"lang": "es", "value": "Vulnerabilidad de CSRF en la interfaz de administraci\u00f3n basada en web en dispositivos Cisco Small Business 220 con firmware en versiones anteriores a 1.0.1.1 permite a atacantes remotos secuestrar la autenticaci\u00f3n de usuarios arbitrarios, tambi\u00e9n conocido como Bug ID CSCuz76230."}], "id": "CVE-2016-1470", "lastModified": "2024-11-21T02:46:30.230", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-09-02T00:59:00.137", "references": [{"source": "ykramarz@cisco.com", "tags": ["Vendor Advisory"], "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-sps"}, {"source": "ykramarz@cisco.com", "url": "http://www.securityfocus.com/bid/92709"}, {"source": "ykramarz@cisco.com", "url": "http://www.securitytracker.com/id/1036722"}, {"source": "ykramarz@cisco.com", "tags": ["Exploit", "Third Party Advisory"], "url": "http://www.synacktiv.com/ressources/advisories_cisco_switch_sg220_csrf.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-sps"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/92709"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1036722"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "http://www.synacktiv.com/ressources/advisories_cisco_switch_sg220_csrf.pdf"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}