Cross-Site Request Forgery in Computrols CBAS Products
CVE-2019-10847

8.8HIGH

Key Information:

Vendor

Computrols

Status
Computrols Building Automation Software
Vendor
CVE Published:
24 May 2019

What is CVE-2019-10847?

The Computrols CBAS software version 18.0.0 is vulnerable to Cross-Site Request Forgery (CSRF), which allows attackers to perform unauthorized actions on behalf of authenticated users. This vulnerability could enable malicious actors to exploit the trust established between the user and the application, potentially leading to data manipulation or unauthorized access. Users are advised to implement appropriate security measures, including ensuring that CSRF tokens are correctly used and validated, to safeguard against such attacks.

References

https://applied-risk.com/labs/advisories
x_refsource_MISC
https://applied-risk.com/index.php/download_file/view/196...
x_refsource_MISC
http://packetstormsecurity.com/files/155247/Computrols-CB...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.