PT-2019-13109 · Cyberpower · Cyberpower Powerpanel Business Edition

Joey Lane · Publicado 2019-07-10 · Atualizado 2019-10-09 · CVE-2019-13071

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CyberPower PowerPanel Business Edition version 3.4.0

Description The issue allows an attacker to submit POST requests to any forms in the web application by exploiting a CSRF weakness in the Agent/Center component. This can be achieved by tricking an authenticated user into visiting an attacker-controlled web page.

Recommendations For CyberPower PowerPanel Business Edition version 3.4.0, consider implementing CSRF protection mechanisms, such as tokens, to prevent unauthorized requests. As a temporary workaround, restrict access to the web application to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2019-13071

Produtos afetados

Cyberpower Powerpanel Business Edition

Referências · 4

• 🔥 http://seclists.org/fulldisclosure/2019/Jul/11 · Exploit
• 🔥 http://packetstormsecurity.com/files/153581/PowerPanel-Business-Edition-3.4.0-Cross-Site-Request-Forgery.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13071 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-13071 · Aviso do Fabricante