CVE-2014-8246

2014-12-1623:59:03

CWE-352

[email protected]

web.nvd.nist.gov

cve-2014-8246

cross-site request forgery

csrf vulnerability

ca release automation

security

vulnerability

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.2 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

67.9%

JSON

Cross-site request forgery (CSRF) vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

Affected configurations

NVD

Node

broadcomrelease_automationRange≤4.7.1

CPENameOperatorVersion
broadcom:release_automationbroadcom release automationle4.7.1

CPE	Name	Operator	Version
broadcom:release_automation	broadcom release automation	le	4.7.1

References

seclists.org/fulldisclosure/2014/Dec/55

securitytracker.com/id?1031375

www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20141215-01-security-notice-for-ca-lisa-release-automation.aspx

www.kb.cert.org/vuls/id/343060

www.securityfocus.com/archive/1/534246/100/0/threaded