CVE-2021-45785 Cross-site request forgery in n/a
An attacker can force a server restart via CSRF, causing denial of service, if a privileged user visits a malicious page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-45785?
CVE-2021-45785 is a medium-severity vulnerability in n/a, published on 24 Jun 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, causing a DoS attack. The attacker must craft a webpage that would perform a GET request to the /api/v1/admin/restart endpoint, then the victim (who has sufficient privileges), would visit the page and the server restart would begin. The attacker must know the full URL that TruDesk is on in order to craft the webpage.
Weakness: CWE-352
Which versions are affected by CVE-2021-45785?
It affects 1 product.
Products include Trudesk Project Trudesk.
How do I fix CVE-2021-45785?
No fix has been published for CVE-2021-45785 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-45785 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-45785 exists.
Other vulnerabilities in n/a
- CVE-2022-2023 Incorrect Use of Privileged APIs in polonel/trudesk
- CVE-2022-1770 Improper Privilege Management in polonel/trudesk
- CVE-2022-2128 Unrestricted Upload of File with Dangerous Type in polonel/trudesk
- CVE-2022-1931 Incorrect Synchronization in polonel/trudesk
- CVE-2022-1947 Use of Incorrect Operator in polonel/trudesk
Sources
Also known as GHSA-w65f-4h2f-cpj2.