CVE-2014-1457

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.15%

Published

Mar 20, 2018

Modified

Nov 20, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which makes it easier for remote attackers to bypass a CSRF protection mechanism by leveraging knowledge of an OWA user name.

Weaknesses (CWE)

CWE-352

Affected Products (1)

openwebanalytics · open_web_analytics (up to 1.5.6)vulnerable

References (8)

http://www.openwebanalytics.com/?p=384

Vendor Advisory

http://www.securityfocus.com/bid/65573

Third Party AdvisoryVDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/91125

Third Party AdvisoryVDB Entry

https://www.secureworks.com/research/swrx-2014-006

ExploitThird Party Advisory

http://www.openwebanalytics.com/?p=384

Vendor Advisory

http://www.securityfocus.com/bid/65573

Third Party AdvisoryVDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/91125

Third Party AdvisoryVDB Entry

https://www.secureworks.com/research/swrx-2014-006

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs