Unscored severity · published Nov 4, 2014
CVE-2014-8472
CA Cloud Service Management (CSM) before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows user-assisted remote attackers to…
–
CVSS
2.2%
EPSS
No
On KEV
Description
CA Cloud Service Management (CSM) before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Cloud Service Management · CA
through 2014 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8472
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8472
Patch
http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20141103-01-security-notice-for-ca-cloud-service-management.aspx
www.securityfocus.com
http://www.securityfocus.com/bid/70923
www.securitytracker.com
http://www.securitytracker.com/id/1031214
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/98535
More from Cloud Service Management
–
CVE-2014-8474
CA Cloud Service Management (CSM) before Summer 2014 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and…
–
CVE-2014-8473
Cross-site request forgery (CSRF) vulnerability in CA Cloud Service Management (CSM) before Summer 2014 allows remote attackers to hijack the authentication of unspecified victims…
–
CVE-2014-8471
CA Cloud Service Management (CSM) before Summer 2014 allows remote attackers to conduct replay attacks via unspecified vectors