PT-2019-18511 · Prima Systems · Flexair

Published 2019-07-01 · Updated 2022-10-25 · CVE-2019-7281

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prima Systems FlexAir versions 2.3.38 and prior

Description The issue allows an unauthenticated user to send unverified HTTP requests. This may enable an attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.

Recommendations For versions 2.3.38 and prior, update to a version later than 2.3.38 to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-7281

Affected Products

Flexair

References · 5

• https://osv.dev/vulnerability/CVE-2019-7281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7281 · Security Note
• https://applied-risk.com/resources/ar-2019-007 · Note
• https://us-cert.gov/ics/advisories/icsa-19-211-02 · Note
• https://applied-risk.com/labs/advisories · Note