CVE-2023-47020

2024-02-0800:00:00

mitre

www.cve.org

cve-2023-47020

cross-site request forgery

ncr terminal handler

privilege escalation

attacker

user account creation

administrator group

wsdl

security controls

custom content types

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.1%

JSON

Multiple Cross-Site Request Forgery (CSRF) chaining in NCR Terminal Handler v.1.5.1 allows privileges to be escalated by an attacker through a crafted request involving user account creation and adding the user to an administrator group. This is exploited by an undisclosed function in the WSDL that lacks security controls and can accept custom content types.