Osprey Pump Controller version 1.01 allows users to perform certain actions via HTTP requests without performing any checks to verify the requests. This may allow an attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.
References
| Link | Resource |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06 | Third Party Advisory US Government Resource |
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 07:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06 - Third Party Advisory, US Government Resource | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
05 Apr 2023, 13:09
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.0 |
| CPE | cpe:2.3:o:propumpservice:osprey_pump_controller_firmware:1.01:*:*:*:*:*:*:* cpe:2.3:h:propumpservice:osprey_pump_controller:-:*:*:*:*:*:*:* |
|
| CWE | CWE-352 | |
| First Time |
Propumpservice osprey Pump Controller Firmware
Propumpservice Propumpservice osprey Pump Controller |
|
| References | (MISC) https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06 - Third Party Advisory, US Government Resource |
28 Mar 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-28 21:15
Updated : 2024-11-21 07:55
NVD link : CVE-2023-28718
Mitre link : CVE-2023-28718
CVE.ORG link : CVE-2023-28718
JSON object : View
Products Affected
propumpservice
- osprey_pump_controller_firmware
- osprey_pump_controller
CWE
CWE-352
Cross-Site Request Forgery (CSRF)