8.8

CVE-2021-47723

Exploit

STVS ProVision Cross-Site Request Forgery (Add Admin)

STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Stvs ≫ Provision Version5.5
Stvs ≫ Provision Version5.6
Stvs ≫ Provision Version5.7
Stvs ≫ Provision Version5.8.6
Stvs ≫ Provision Version5.9.0
Stvs ≫ Provision Version5.9.1
Stvs ≫ Provision Version5.9.7
Stvs ≫ Provision Version5.9.9
Stvs ≫ Provision Version5.9.10
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.094
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
disclosure@vulncheck.com 6.9 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://www.exploit-db.com/exploits/49482
Technical Description
http://www.stvs.ch
Product
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5625.php
Third Party Advisory
https://www.vulncheck.com/advisories/stvs-provision-cross-site-request-forgery-add-admin
Third Party Advisory