CVE-2016-0891

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 3.6%

from disclosure to weapon7 days

Published on NVDApr 20

1st PoC+7d

exploitation probability

3.6%top 12% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before 3.7 allow remote attackers to hijack the authentication of administrators.

Affected products

n/a · n/a

public PoCs found — 3✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/39738 cve_referencepacketstormsecurity.com/files/136837/EMC-ViPR-SRM-Cross-Site-Request-Forgery.htmlunverified cve_referencewww.exploit-db.com/exploits/39738/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/136837/EMC-ViPR-SRM-Cross-Site-Request-Forgery.html http://seclists.org/bugtraq/2016/Apr/106 http://seclists.org/fulldisclosure/2016/Apr/89 https://www.exploit-db.com/exploits/39738/https://www.securify.nl/advisory/SFY20141109/emc_m_r__watch4net__lacks_c%20ross_site_request_forgery_protection.html http://www.securityfocus.com/archive/1/538207/100/0/threaded