Lucene search

GoogleOSV:CVE-2023-38885

HistoryNov 20, 2023 - 7:15 p.m.

CVE-2023-38885

2023-11-2019:15:08

Google

osv.dev

opensis

community edition

csrf

vulnerability

security

software

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.6%

JSON

OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request.

CPENameOperatorVersion
opensis-responsive-designeqV8.0
opensis-responsive-designeqV9.0
opensis-responsive-designeqV7.5
opensis-responsive-designeq7.1
opensis-responsive-designeqVer7.0beta1
opensis-responsive-designeqer7.4
opensis-responsive-designeqer7.1
opensis-responsive-designeq7.3
opensis-responsive-designeqV7.6
opensis-responsive-designeqVer7.0Prod

Name	Operator	Version
opensis-responsive-design	eq	V8.0
opensis-responsive-design	eq	V9.0
opensis-responsive-design	eq	V7.5
opensis-responsive-design	eq	7.1
opensis-responsive-design	eq	Ver7.0beta1
opensis-responsive-design	eq	er7.4
opensis-responsive-design	eq	er7.1
opensis-responsive-design	eq	7.3
opensis-responsive-design	eq	V7.6
opensis-responsive-design	eq	Ver7.0Prod

Rows per page:

1-10 of 121

References

github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38885

github.com/OS4ED/openSIS-Classic

www.os4ed.com/

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.6%

JSON

Related for OSV:CVE-2023-38885