CSRF in ePO leading to privilege escalation

CVE-2023-5444

What is CVE-2023-5444?

A Cross Site Request Forgery vulnerability exists in the ePolicy Orchestrator platform prior to version 5.10.0 CP1 Update 2. This flaw enables a remote user with low privileges to perform unauthorized actions, specifically allowing the addition of new users with administrator rights on the ePO server. The attack requires manipulation of the HTTP payload during submission, affecting the integrity of the server's user management functionality. Users should ensure their systems are updated to the latest versions to mitigate this security risk.

References