CVE-2013-6443 Cross-site request forgery in n/a
Remote attackers can bypass CSRF protection in CloudForms Management Engine to perform destructive actions on behalf of authenticated users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2013-6443?
CVE-2013-6443 is a medium-severity vulnerability in n/a, published on 23 Jan 2014. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.
Weakness: CWE-352
Which versions are affected by CVE-2013-6443?
It affects 2 products.
Linux distribution packages (7)
cfme Red Hat:cloudforms_managementengine:5::el6 | All versions | 0:5.2.1.8-1.el6cf |
cfme-appliance Red Hat:cloudforms_managementengine:5::el6 | All versions | 0:5.2.1.8-1.el6cf |
cfme-debuginfo Red Hat:cloudforms_managementengine:5::el6 | All versions | 0:5.2.1.8-1.el6cf |
cfme-lib Red Hat:cloudforms_managementengine:5::el6 | All versions | 0:5.2.1.8-1.el6cf |
mingw32-cfme-host Red Hat:cloudforms_managementengine:5::el6 | All versions | 0:5.2.1.8-1.el6cf |
ruby193-rubygem-activerecord Red Hat:cloudforms_managementengine:5::el6 | All versions | 1:3.2.13-4.el6cf |
ruby193-rubygem-linux_admin Red Hat:cloudforms_managementengine:5::el6 | All versions | 0:0.5.6-1.el6cf |
Products include Redhat Cloudforms, Redhat Cloudforms 3.0 Management Engine.
How do I fix CVE-2013-6443?
Upgrade to a fixed version.
Is CVE-2013-6443 being exploited?
There is no known exploitation of CVE-2013-6443 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-vvp8-xf2f-vgc6, RHSA-2014:0025.