CVE-2019-17118

Exploit

EPSS 0.94%
Veröffentlicht 17.10.2019 18:15:12
Zuletzt bearbeitet 21.11.2024 04:31:43
Erkennungen
Login

A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as (1) create or delete admin users; (2) create or delete groups; or (3) create, delete, enable, or disable normal users or devices.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 7

NVD 47 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Wikidsystems ≫ 2fa Enterprise Server Version 3.4.81 Update b676

Wikidsystems ≫ 2fa Enterprise Server Version 3.4.85 Update b780

Wikidsystems ≫ 2fa Enterprise Server Version 3.4.87 Update b1092

Wikidsystems ≫ 2fa Enterprise Server Version 3.4.87 Update b1159

Wikidsystems ≫ 2fa Enterprise Server Version 3.4.87 Update b1169

Wikidsystems ≫ 2fa Enterprise Server Version 3.4.87 Update b1216

Wikidsystems ≫ 2fa Enterprise Server Version 3.4.87 Update b824

Wikidsystems ≫ 2fa Enterprise Server Version 3.4.87 Update b839

Wikidsystems ≫ 2fa Enterprise Server Version 3.5.0 Update b1342

Wikidsystems ≫ 2fa Enterprise Server Version 3.5.0 Update b1352

Wikidsystems ≫ 2fa Enterprise Server Version 3.5.0 Update b1359

Wikidsystems ≫ 2fa Enterprise Server Version 3.5.0 Update b1373

Wikidsystems ≫ 2fa Enterprise Server Version 3.5.0 Update b1403

Wikidsystems ≫ 2fa Enterprise Server Version 3.5.0 Update b1411

Wikidsystems ≫ 2fa Enterprise Server Version 3.5.0 Update b1421

Wikidsystems ≫ 2fa Enterprise Server Version 3.5.0 Update b1428

Wikidsystems ≫ 2fa Enterprise Server Version 3.5.0 Update b1438

Wikidsystems ≫ 2fa Enterprise Server Version 3.5.0 Update b1472

Wikidsystems ≫ 2fa Enterprise Server Version 3.5.0 Update b1542

Wikidsystems ≫ 2fa Enterprise Server Version 3.5.0 Update b1580

Wikidsystems ≫ 2fa Enterprise Server Version 3.6.0 Update b1659

Wikidsystems ≫ 2fa Enterprise Server Version 3.6.0 Update b1672

Wikidsystems ≫ 2fa Enterprise Server Version 4.0 Update b1787

Wikidsystems ≫ 2fa Enterprise Server Version 4.0 Update b1798

Wikidsystems ≫ 2fa Enterprise Server Version 4.0 Update b1803

Wikidsystems ≫ 2fa Enterprise Server Version 4.0.1 Update b1817

Wikidsystems ≫ 2fa Enterprise Server Version 4.0.1 Update b1821

Wikidsystems ≫ 2fa Enterprise Server Version 4.0.1 Update b1905

Wikidsystems ≫ 2fa Enterprise Server Version 4.0.1 Update b1906

Wikidsystems ≫ 2fa Enterprise Server Version 4.0.2 Update b1917

Wikidsystems ≫ 2fa Enterprise Server Version 4.0.2 Update b1921

Wikidsystems ≫ 2fa Enterprise Server Version 4.1.0 Update b1926

Wikidsystems ≫ 2fa Enterprise Server Version 4.1.0 Update b1941

Wikidsystems ≫ 2fa Enterprise Server Version 4.1.0 Update b1949

Wikidsystems ≫ 2fa Enterprise Server Version 4.1.0 Update b1955

Wikidsystems ≫ 2fa Enterprise Server Version 4.2.0 Update b1978

Wikidsystems ≫ 2fa Enterprise Server Version 4.2.0 Update b1981

Wikidsystems ≫ 2fa Enterprise Server Version 4.2.0 Update b1984

Wikidsystems ≫ 2fa Enterprise Server Version 4.2.0 Update b2007

Wikidsystems ≫ 2fa Enterprise Server Version 4.2.0 Update b2014

Wikidsystems ≫ 2fa Enterprise Server Version 4.2.0 Update b2016

Wikidsystems ≫ 2fa Enterprise Server Version 4.2.0 Update b2020

Wikidsystems ≫ 2fa Enterprise Server Version 4.2.0 Update b2023

Wikidsystems ≫ 2fa Enterprise Server Version 4.2.0 Update b2028

Wikidsystems ≫ 2fa Enterprise Server Version 4.2.0 Update b2032

Wikidsystems ≫ 2fa Enterprise Server Version 4.2.0 Update b2047

Wikidsystems ≫ 2fa Enterprise Server Version 4.2.0 Update b2053

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.94%	0.561

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html

Third Party Advisory

Exploit

VDB Entry

http://seclists.org/fulldisclosure/2019/Oct/35

Third Party Advisory

Exploit

Mailing List

https://www.securitymetrics.com/blog/

Vendor Advisory

https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-csrf

Patch

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2019-17118

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-17118

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-17118

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2019-17118