CVE-2022-23904 Cross-site request forgery in n/a
An authenticated user can exploit CSRF to escalate privileges to admin, gaining control of the AuctionWorx admin panel.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-23904?
CVE-2022-23904 is a high-severity vulnerability in n/a, published on 2 May 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Rainworx Auctionworx < 3.1R2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack that allows an authenticated user to upgrade his account to admin and gain access to the auctionworx admin control panel. This vulnerability affects AuctionWorx Enterprise and AuctionWorx: Events Edition.
Weakness: CWE-352
Which versions are affected by CVE-2022-23904?
It affects 1 product.
Products include Rainworx Auctionworx.
How do I fix CVE-2022-23904?
No fix has been published for CVE-2022-23904 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-23904 being exploited?
There is no known exploitation of CVE-2022-23904 in the wild and no public exploit code.
Sources
Also known as GHSA-vhxp-r6hh-hf7v.