Cross-Site Request Forgery in EPSON EPS TSE Server 8 by EPSON
CVE-2020-28931

8.8HIGH

Key Information:

Vendor

Epson

Status
Eps Tse Server 8 Firmware
Vendor
CVE Published:
16 December 2020

What is CVE-2020-28931?

The EPSON EPS TSE Server 8 (version 21.0.11) is vulnerable to Cross-Site Request Forgery due to the absence of an anti-CSRF token in its entire administrative interface. This lack of validation allows an unauthenticated attacker to exploit the system by tricking an administrator into executing malicious POST requests simply by visiting a compromised website. Effective remediation measures should be prioritized to protect administrative actions from unauthorized execution.

References

https://blog.bssi.fr/multiple-vulnerabilities-within-epso...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.