CVE-2021-47723mediumCWE-352

CVE-2021-47723: medium-severity vulnerability in STVS ProVision

STVS ProVision Cross-Site Request Forgery (Add Admin)

Published · Updated

Follow this CVE+ Monitor STVS ProVision

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.2%
STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
STVS SA · STVS ProVision
Related CVEs — STVS ProVision

In the same product, most dangerous first.

CVE-2021-47724HIGHSTVS ProVision Authenticated File Disclosure via archive.rbEPSS 0.8%CVE-2021-47725MEDIUMSTVS ProVision 5.9.10 Authenticated Reflected Cross-Site Scripting via Files ParameterEPSS 0.2%