What is CVE-2016-4504?

CVE-2016-4504 is a high-severity vulnerability in Meteocontrol Weblog, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2017-03-21.

How severe is CVE-2016-4504?

High severity. CVSS v3 base score is 8.8 out of 10.

CSRF in Meteocontrol Weblog

CVE-2016-4504

A Cross-Site Request Forgery issue was discovered in Meteocontrol WEB'log Basic 100 all versions, Light all versions, Pro all versions, and Pro Unlimited all versions. There is no CSRF Token generated per page or per function.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.005 (39.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Meteocontrol Weblog
N/a Meteocontrol Web'log — versions Meteocontrol WEB'log

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2016-4504?: CVE-2016-4504 is a high-severity vulnerability in Meteocontrol Weblog, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2017-03-21.
How severe is CVE-2016-4504?: High severity. CVSS v3 base score is 8.8 out of 10.