8.8

CVE-2019-17118

Exploit

A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as (1) create or delete admin users; (2) create or delete groups; or (3) create, delete, enable, or disable normal users or devices.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wikidsystems ≫ 2fa Enterprise Server Version3.4.81 Updateb676
Wikidsystems ≫ 2fa Enterprise Server Version3.4.85 Updateb780
Wikidsystems ≫ 2fa Enterprise Server Version3.4.87 Updateb1092
Wikidsystems ≫ 2fa Enterprise Server Version3.4.87 Updateb1159
Wikidsystems ≫ 2fa Enterprise Server Version3.4.87 Updateb1169
Wikidsystems ≫ 2fa Enterprise Server Version3.4.87 Updateb1216
Wikidsystems ≫ 2fa Enterprise Server Version3.4.87 Updateb824
Wikidsystems ≫ 2fa Enterprise Server Version3.4.87 Updateb839
Wikidsystems ≫ 2fa Enterprise Server Version3.5.0 Updateb1342
Wikidsystems ≫ 2fa Enterprise Server Version3.5.0 Updateb1352
Wikidsystems ≫ 2fa Enterprise Server Version3.5.0 Updateb1359
Wikidsystems ≫ 2fa Enterprise Server Version3.5.0 Updateb1373
Wikidsystems ≫ 2fa Enterprise Server Version3.5.0 Updateb1403
Wikidsystems ≫ 2fa Enterprise Server Version3.5.0 Updateb1411
Wikidsystems ≫ 2fa Enterprise Server Version3.5.0 Updateb1421
Wikidsystems ≫ 2fa Enterprise Server Version3.5.0 Updateb1428
Wikidsystems ≫ 2fa Enterprise Server Version3.5.0 Updateb1438
Wikidsystems ≫ 2fa Enterprise Server Version3.5.0 Updateb1472
Wikidsystems ≫ 2fa Enterprise Server Version3.5.0 Updateb1542
Wikidsystems ≫ 2fa Enterprise Server Version3.5.0 Updateb1580
Wikidsystems ≫ 2fa Enterprise Server Version3.6.0 Updateb1659
Wikidsystems ≫ 2fa Enterprise Server Version3.6.0 Updateb1672
Wikidsystems ≫ 2fa Enterprise Server Version4.0 Updateb1787
Wikidsystems ≫ 2fa Enterprise Server Version4.0 Updateb1798
Wikidsystems ≫ 2fa Enterprise Server Version4.0 Updateb1803
Wikidsystems ≫ 2fa Enterprise Server Version4.0.1 Updateb1817
Wikidsystems ≫ 2fa Enterprise Server Version4.0.1 Updateb1821
Wikidsystems ≫ 2fa Enterprise Server Version4.0.1 Updateb1905
Wikidsystems ≫ 2fa Enterprise Server Version4.0.1 Updateb1906
Wikidsystems ≫ 2fa Enterprise Server Version4.0.2 Updateb1917
Wikidsystems ≫ 2fa Enterprise Server Version4.0.2 Updateb1921
Wikidsystems ≫ 2fa Enterprise Server Version4.1.0 Updateb1926
Wikidsystems ≫ 2fa Enterprise Server Version4.1.0 Updateb1941
Wikidsystems ≫ 2fa Enterprise Server Version4.1.0 Updateb1949
Wikidsystems ≫ 2fa Enterprise Server Version4.1.0 Updateb1955
Wikidsystems ≫ 2fa Enterprise Server Version4.2.0 Updateb1978
Wikidsystems ≫ 2fa Enterprise Server Version4.2.0 Updateb1981
Wikidsystems ≫ 2fa Enterprise Server Version4.2.0 Updateb1984
Wikidsystems ≫ 2fa Enterprise Server Version4.2.0 Updateb2007
Wikidsystems ≫ 2fa Enterprise Server Version4.2.0 Updateb2014
Wikidsystems ≫ 2fa Enterprise Server Version4.2.0 Updateb2016
Wikidsystems ≫ 2fa Enterprise Server Version4.2.0 Updateb2020
Wikidsystems ≫ 2fa Enterprise Server Version4.2.0 Updateb2023
Wikidsystems ≫ 2fa Enterprise Server Version4.2.0 Updateb2028
Wikidsystems ≫ 2fa Enterprise Server Version4.2.0 Updateb2032
Wikidsystems ≫ 2fa Enterprise Server Version4.2.0 Updateb2047
Wikidsystems ≫ 2fa Enterprise Server Version4.2.0 Updateb2053
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.538
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

http://seclists.org/fulldisclosure/2019/Oct/35
Third Party Advisory
Exploit
Mailing List