8.8

CVE-2022-25778

Unload handlers may unintentionally defeat CSRF guards

Cross-Site Request Forgery (CSRF) vulnerability in Web UI of Secomea GateManager allows phishing attacker to issue get request in logged in user session.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Secomea ≫ Gatemanager 4250 Firmware Version < 9.7.622134021
   Secomea ≫ Gatemanager 4250 Version-
Secomea ≫ Gatemanager 4260 Firmware Version < 9.7.622134021
   Secomea ≫ Gatemanager 4260 Version-
Secomea ≫ Gatemanager 8250 Firmware Version < 9.7.622134021
   Secomea ≫ Gatemanager 8250 Version-
Secomea ≫ Gatemanager 9250 Firmware Version < 9.7.622134021
   Secomea ≫ Gatemanager 9250 Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.188
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
VulnerabilityReporting@secomea.com 4.2 1.6 2.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://www.secomea.com/support/cybersecurity-advisory/
Vendor Advisory