Medium severity5.7NVD Advisory· Published Oct 18, 2017· Updated May 13, 2026
CVE-2017-14956
CVE-2017-14956
Description
AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/ossim/report/wizard_email.php" script. Besides offering an export via a local download, the script also offers the possibility to send out any report via email to a given address (either in PDF or XLS format). Since there is no anti-CSRF token protecting this functionality, it is vulnerable to Cross-Site Request Forgery attacks.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- packetstormsecurity.com/files/144617/AlienVault-USM-5.4.2-Cross-Site-Request-Forgery.htmlnvdExploitThird Party AdvisoryVDB Entry
- seclists.org/fulldisclosure/2017/Oct/32nvdExploitMailing ListThird Party Advisory
- www.exploit-db.com/exploits/42988/nvdExploitThird Party AdvisoryVDB Entry
- www.rcesecurity.com/2017/10/cve-2017-14956-alienvault-usm-leaks-sensitive-compliance-information-via-csrf/nvdExploitThird Party Advisory
- www.securityfocus.com/archive/1/541342/100/0/threadednvdThird Party AdvisoryVDB Entry
- www.securityfocus.com/bid/101284nvdThird Party AdvisoryVDB Entry
News mentions
0No linked articles in our index yet.