CVE-2020-24033 Cross-site request forgery in n/a
Remote attackers can forge requests to change settings and create privileged users due to missing CSRF protection in the web interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-24033?
CVE-2020-24033 is a high-severity vulnerability in n/a, published on 22 Oct 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token authentication mechanism that allows remote attackers to forge requests on behalf of a site administrator to change all settings including deleting users, creating new users with escalated privileges.
Weakness: CWE-352
Which versions are affected by CVE-2020-24033?
It affects 1 product.
Products include Fs S3900 24t4s Firmware.
How do I fix CVE-2020-24033?
No fix has been published for CVE-2020-24033 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-24033 being exploited?
There is no known exploitation of CVE-2020-24033 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hmcm-7mfh-522v.