PT-2025-3345 · Geovision · Geovision Gv-Asweb

Published 2025-02-02 · Updated 2025-03-04 · CVE-2024-56903

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Geovision GV-ASWeb versions 6.1.1.0 and earlier

Description The issue allows attackers to execute arbitrary operations via supplying a crafted HTTP request, specifically due to a Cross-Site Request Forgery (CSRF) in Geovision GV-ASWeb. This enables attackers to perform unauthorized actions.

Recommendations For Geovision GV-ASWeb versions 6.1.1.0 and earlier, update to a version later than 6.1.1.0 to resolve the issue. As a temporary workaround, consider implementing additional validation for HTTP requests to minimize the risk of exploitation. Restrict access to sensitive operations to minimize the risk of unauthorized actions.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-56903

Affected Products

Geovision Gv-Asweb

References · 8

• 🔥 https://github.com/DRAGOWN/CVE-2024-56903 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-56903 · Security Note
• https://twitter.com/CVEnew/status/1886523335464640610 · Twitter Post
• https://twitter.com/DragownSec/status/1886158686508175784 · Twitter Post
• https://t.me/cvenotify/113476 · Telegram Post
• https://t.me/cvenotify/113474 · Telegram Post
• https://t.me/cvenotify/113256 · Telegram Post
• https://t.me/cvenotify/113254 · Telegram Post