PT-2021-23449 · Webtareas · Webtareas

Published 2021-10-08 · Updated 2021-10-15 · CVE-2021-41916

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions webTareas versions 2.4 and earlier

Description A Cross-Site Request Forgery (CSRF) issue allows a remote attacker to create a new administrative profile and add a new user to the new profile without the victim's knowledge. This can be achieved by enticing an authenticated admin user to visit an attacker's web page.

Recommendations For webTareas versions 2.4 and earlier, consider implementing anti-CSRF measures, such as token-based validation, to prevent unauthorized requests. As a temporary workaround, restrict access to administrative profile creation and user addition features until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-41916

Affected Products

Webtareas

References · 4

• 🔥 https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-41916 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41916 · Vendor Advisory
• https://t.me/cibsecurity/30258 · Telegram Post