CVEvulnerability
CVE-2020-21989
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-04-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
HomeAutomation 3.3.2 is affected by Cross Site Request Forgery (CSRF). The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.
Affected configurations
• homeautomation project homeautomation 3.3.2
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://www.exploit-db.com/exploits/47808 Exploit, Third Party Advisory, VDB Entry
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5558.php Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/47808 Exploit, Third Party Advisory, VDB Entry
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5558.php Exploit, Third Party Advisory