CVE-2017-14956

PoC ×4—

CVSS 3.0

5.7 medium

EPSS

2%p78

Published

Oct 18, 2017 (Oct 18, 2017)

Modified

Jun 17, 2026

Description

AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/ossim/report/wizard_email.php" script. Besides offering an export via a local download, the script also offers the possibility to send out any report via email to a given address (either in PDF or XLS format). Since there is no anti-CSRF token protecting this functionality, it is vulnerable to Cross-Site Request Forgery attacks.

Vendors: alienvault
Products: unified security management
Weakness: CWE-352
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.9%)

In the news0 stories

No ingested article mentions this CVE yet.