CVE-2019-18651 - A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application users) by sending a crafted HTML document or encoded URL to a user that the website trusts

Back Back to CVE browser

MEDIUM

A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application users) by sending a crafted HTML document or encoded URL to a user that the website trusts

Published Nov 14, 2019

6.5

MEDIUM

CVSS 3.1

EPSS 0.71%

Description

A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application users) by sending a crafted HTML document or encoded URL to a user that the website trusts. The user needs to have an active privileged session.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8370
Advisory
https://gitlab.com/crypt0crc/cve-2019-18651
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8370		Advisory
https://gitlab.com/crypt0crc/cve-2019-18651		x_refsource_MISCExploitThird Party Advisory