CVE-2019-19987 Cross-site request forgery in n/a
Cross-Site Request Forgery in Selesta Visual Access Manager allows attackers to change passwords or add users via malicious forms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-19987?
CVE-2019-19987 is a medium-severity vulnerability in n/a, published on 26 Feb 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows Cross-Site Request Forgery (CSRF) on any HTML form. An attacker can exploit the vulnerability to abuse functionalities such as change password, add user, add privilege, and so on.
Weakness: CWE-352
Which versions are affected by CVE-2019-19987?
It affects 1 product.
Products include Seling Visual Access Manager.
How do I fix CVE-2019-19987?
No fix has been published for CVE-2019-19987 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-19987 being exploited?
There is no known exploitation of CVE-2019-19987 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-46v6-rwf6-m6p5.