Lucene search

INCIBECVELIST:CVE-2024-0555

HistoryJan 16, 2024 - 10:09 a.m.

CVE-2024-0555 Cross-Site Request Forgery (CSRF) vulnerability on WIC1200

2024-01-1610:09:58

CWE-352

INCIBE

www.cve.org

cross-site request forgery

wic1200

vulnerability

implementation

csrf token

authenticated user

unwanted actions

4.6 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

0.001 Low

EPSS

Percentile

19.0%

JSON

A Cross-Site Request Forgery (CSRF) vulnerability has been found on WIC1200, affecting version 1.1. An authenticated user could lead another user into executing unwanted actions inside the application they are logged in. This vulnerability is possible due to the lack of propper CSRF token implementation.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "WIC1200",
    "vendor": "Full Compass Systems",
    "versions": [
      {
        "status": "affected",
        "version": "1.1"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-full-compass-systems-wic1200