8
CVE-2023-28718
- EPSS 0.25%
- Veröffentlicht 28.03.2023 21:15:11
- Zuletzt bearbeitet 21.11.2024 07:55:52
- CVE-Watchlists
- Unerledigt
LoginCVE-2023-28718
Osprey Pump Controller version 1.01 allows users to perform certain actions via HTTP requests without performing any checks to verify the requests. This may allow an attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Propumpservice ≫ Osprey Pump Controller Firmware Version1.01
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.25% | 0.165 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 8 | 2.1 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
|
| DHS.gov | 7.1 | 1.2 | 5.9 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06