Lucene search
HistoryNov 20, 2023 - 7:15 p.m.
CVE-2023-38885
opensis
csrf
vulnerability
authentication
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
25.4%
OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request.
Affected configurations
Node
os4edopensisMatch9.0community
Related
cve
cve
CVE-2023-38885
2023-11-20 19:15:08
osv
osv
CVE-2023-38885
2023-11-20 19:15:08
cvelist
cvelist
CVE-2023-38885
2023-11-20 00:00:00
prion
prion
Cross site request forgery (csrf)
2023-11-20 19:15:00
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
25.4%
Related for NVD:CVE-2023-38885