CVEvulnerability
CVE-2023-47020
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-02-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-352
Description
Multiple Cross-Site Request Forgery (CSRF) chaining in NCR Terminal Handler v.1.5.1 allows privileges to be escalated by an attacker through a crafted request involving user account creation and adding the user to an administrator group. This is exploited by an undisclosed function in the WSDL that lacks security controls and can accept custom content types.
Affected configurations
• ncratleos terminal handler 1.5.1
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47020 Third Party Advisory
- https://youtu.be/pGB3LKdf64w Exploit
- https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47020 Third Party Advisory
- https://youtu.be/pGB3LKdf64w Exploit