CVE-2024-5676

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-5676
The Paradox IP150 Internet Module in version 1.40.00 is vulnerable to Cross-Site Request Forgery (CSRF) attacks due to a lack of countermeasures and the use of the HTTP method `GET` to introduce changes in the system.

6.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://seclists.org/fulldisclosure/2024/Jun/8
https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240321-01_Paradox_Cross_Site_Request_Forgery
https://www.paradox.com/Products/default.asp?CATID=3&SUBCATID=38&PRD=563
http://seclists.org/fulldisclosure/2024/Jun/8
https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240321-01_Paradox_Cross_Site_Request_Forgery
https://www.paradox.com/Products/default.asp?CATID=3&SUBCATID=38&PRD=563
Configurations

No configuration.

History

21 Nov 2024, 09:48

Type Values Removed Values Added
References () http://seclists.org/fulldisclosure/2024/Jun/8 - () http://seclists.org/fulldisclosure/2024/Jun/8 -
References () https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240321-01_Paradox_Cross_Site_Request_Forgery - () https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240321-01_Paradox_Cross_Site_Request_Forgery -
References () https://www.paradox.com/Products/default.asp?CATID=3&SUBCATID=38&PRD=563 - () https://www.paradox.com/Products/default.asp?CATID=3&SUBCATID=38&PRD=563 -

24 Jun 2024, 05:15

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2024/Jun/8 -

20 Jun 2024, 12:44

Type Values Removed Values Added
Summary
  • (es) El módulo de Internet Paradox IP150 en la versión 1.40.00 es vulnerable a ataques de Cross-Site Request Forgery (CSRF) debido a la falta de contramedidas y al uso del método HTTP `GET` para introducir cambios en el sistema.

19 Jun 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-19 10:15

Updated : 2024-11-21 09:48

NVD link : CVE-2024-5676

Mitre link : CVE-2024-5676

CVE.ORG link : CVE-2024-5676

JSON object : View

Products Affected

No product.

CWE
CWE-352

Cross-Site Request Forgery (CSRF)