Lucene search

MitreCVE-2021-45785

HistoryJun 24, 2024 - 7:15 p.m.

CVE-2021-45785

2024-06-2419:15:11

CWE-352

mitre

web.nvd.nist.gov

trudesk help desk

csrf vulnerability

server restart

dos attack

get request

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

17.1%

JSON

TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, causing a DoS attack. The attacker must craft a webpage that would perform a GET request to the /api/v1/admin/restart endpoint, then the victim (who has sufficient privileges), would visit the page and the server restart would begin. The attacker must know the full URL that TruDesk is on in order to craft the webpage.

Affected configurations

Nvd

Node

trudesk_projecttrudeskMatch1.1.11

VendorProductVersionCPE
trudesk_projecttrudesk1.1.11cpe:2.3:a:trudesk_project:trudesk:1.1.11:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
trudesk_project	trudesk	1.1.11	cpe:2.3:a:trudesk_project:trudesk:1.1.11:::::::*

References

1d8.github.io/cves/cve_2021_45785/

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

17.1%

JSON

Related for CVE-2021-45785