What is the CVSS score of CVE-2013-3694?

CVE-2013-3694 has a CVSS 2.0 base score of 6.8 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2013-3694?

Yes, a public proof-of-concept exploit is available for CVE-2013-3694. Prioritise patching immediately. EPSS: 0.1%.

Blackberry Link CVE-2013-3694

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2013-11-18 cve@mitre.org

CSRF Microsoft Blackberry Link

6.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Nov 18, 2013 - 03:55 cve.org

MEDIUM 6.8

DescriptionCVE.org

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding.

AnalysisAI

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding. Affected products include: Blackberry Blackberry Link. Version information: before 1.2.1.31.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.