8.8
CVE-2022-32555
- EPSS 0.32%
- Veröffentlicht 13.09.2022 20:15:09
- Zuletzt bearbeitet 05.06.2025 19:15:24
- CVE-Watchlists
- Unerledigt
LoginUnisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authenticate the POST request. Thus, a cross-site request forgery attack could occur.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Unisys ≫ Data Exchange Management Studio Version6.0.ic1
Unisys ≫ Data Exchange Management Studio Version7.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.32% | 0.245 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| CISA-ADP | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
https://unisys.com
https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=69