PT-2025-50232 · Openbmc · Openbmc

Published 2025-12-09 · Updated 2025-12-19 · CVE-2021-47702

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenBMCS version 2.4

Description OpenBMCS version 2.4 contains a Cross-Site Request Forgery (CSRF) issue. An attacker can perform actions with administrative privileges by exploiting the sendFeedback.php API endpoint. Attackers can submit malicious requests to trigger unintended actions, such as sending emails or modifying system settings.

Recommendations Apply any available updates or patches to address the issue in OpenBMCS version 2.4.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-47702

Affected Products

Openbmc

References · 8

• 🔥 https://exploit-db.com/exploits/50667 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2022-5691.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47702 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47702 · Vendor Advisory
• https://t.me/cveNotify/146395 · Telegram Post
• https://openbmcs.com · Note
• https://vulncheck.com/advisories/openbmcs-cross-site-request-forgery-csrf-via-sendfeedbackphp · Note
• https://twitter.com/CVEnew/status/1998732811197624547 · Twitter Post