CVE-2019-16002CWE-352

Cisco SD-WAN Solution vManage Cross-Site Request Forgery Vulnerability

Medium · published November 26, 2019

CVSS v3.0
6.5
EPSS
1%
Percentile
51.4
In the wild
Unconfirmed
What it is

A vulnerability in the vManage web-based UI (web UI) of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected instance of vManage. An attacker could exploit this vulnerability by persuading a user to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00671 · 51.4th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2019-11-26T03:41Z
EPSS history
Timeline
  • 26 NOV 03:41Z
    Cisco SD-WAN Solution vManage Cross-Site Request Forgery Vulnerability
    cvelistv5