CVE-2023-27295

Summary

Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy page that executes Javascript in an authenticated user's session when visited.

Affected Software

Weaknesses

• Cross-Site Request Forgery

ADP Enrichment

CVE Program Container

Additional References

• https://www.tenable.com/security/research/tra-2023-8

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://www.tenable.com/security/research/tra-2023-8

• ←Previous
• Next→