Lucene search

GitHub Advisory DatabaseGHSA-67GV-XRW7-P72W

HistoryDec 19, 2023 - 12:30 p.m.

Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability

2023-12-1912:30:19

CWE-352

GitHub Advisory Database

github.com

phpsysinfo

csrf

xml.php

vulnerability

remote attacker

sensitive information

software

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

6.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

43.0%

JSON

Cross Site Request Forgery (CSRF) vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file. Phpsysinfo 3.4.3 disables the functionality by default but the users may enable the vulnerable functionality.

Affected configurations

Vulners

Node

phpsysinfophpsysinfoRange<3.4.3

CPENameOperatorVersion
phpsysinfo/phpsysinfolt3.4.3

CPE	Name	Operator	Version
	phpsysinfo/phpsysinfo	lt	3.4.3

References

github.com/advisories/GHSA-67gv-xrw7-p72w

github.com/Hebing123/cve/issues/5

github.com/phpsysinfo/phpsysinfo/commit/4f2cee505e4f2e9b369a321063ff2c5e0c34ba45

huntr.com/bounties/ca6d669f-fd82-4188-aae2-69e08740d982/

nvd.nist.gov/vuln/detail/CVE-2023-49006

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

6.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

43.0%

JSON

Related for GHSA-67GV-XRW7-P72W