Lucene search

[email protected]NVD:CVE-2023-33534

HistoryJul 31, 2023 - 2:15 p.m.

CVE-2023-33534

2023-07-3114:15:10

CWE-352

[email protected]

web.nvd.nist.gov

cross-site request forgery

guanzhou tozed kangwei intelligent technology

zlts10g software

takeover user accounts

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

A Cross-Site Request Forgery (CSRF) in Guanzhou Tozed Kangwei Intelligent Technology ZLTS10G software version S10G_3.11.6 allows attackers to takeover user accounts via sending a crafted POST request to /goform/goform_set_cmd_process.

Affected configurations

Nvd

Node

sztozedzlt_s10g_firmwareMatch3.11.6

AND

sztozedzlt_s10gMatch-

VendorProductVersionCPE
sztozedzlt_s10g_firmware3.11.6cpe:2.3:o:sztozed:zlt_s10g_firmware:3.11.6:*:*:*:*:*:*:*
sztozedzlt_s10g-cpe:2.3:h:sztozed:zlt_s10g:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sztozed	zlt_s10g_firmware	3.11.6	cpe:2.3:o:sztozed:zlt_s10g_firmware:3.11.6:::::::*
sztozed	zlt_s10g	-	cpe:2.3:h:sztozed:zlt_s10g:-:::::::*

References

rodelllemit.medium.com/cve-2023-33534-account-takeover-through-csrf-vulnerability-461de6f1b696

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

Related for NVD:CVE-2023-33534

prion1 cve1 cvelist1