8.8
CVE-2020-21989
- EPSS 0.75%
- Veröffentlicht 27.04.2021 18:15:07
- Zuletzt bearbeitet 21.11.2024 05:12:58
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginHomeAutomation 3.3.2 is affected by Cross Site Request Forgery (CSRF). The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Homeautomation Project ≫ Homeautomation Version3.3.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.75% | 0.5 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
https://www.exploit-db.com/exploits/47808
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5558.php