PT-2019-13109 · Cyberpower · Cyberpower Powerpanel Business Edition

Joey Lane · Published 2019-07-10 · Updated 2019-10-09 · CVE-2019-13071

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CyberPower PowerPanel Business Edition version 3.4.0

Description The issue allows an attacker to submit POST requests to any forms in the web application by exploiting a CSRF weakness in the Agent/Center component. This can be achieved by tricking an authenticated user into visiting an attacker-controlled web page.

Recommendations For CyberPower PowerPanel Business Edition version 3.4.0, consider implementing CSRF protection mechanisms, such as tokens, to prevent unauthorized requests. As a temporary workaround, restrict access to the web application to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-13071

Affected Products

Cyberpower Powerpanel Business Edition

References · 4

• 🔥 http://seclists.org/fulldisclosure/2019/Jul/11 · Exploit
• 🔥 http://packetstormsecurity.com/files/153581/PowerPanel-Business-Edition-3.4.0-Cross-Site-Request-Forgery.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13071 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13071 · Vendor Advisory