CVE-2022-30280 Cross-site request forgery in n/a

High 8.8 Published 24 Jul 2023 Updated 24 Oct 2024

A CSRF vulnerability in Nokia NetAct allows attackers to create users with arbitrary privileges, including administrative access, via social engineering.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-30280?

CVE-2022-30280 is a high-severity vulnerability in n/a, published on 24 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

/SecurityManagement/html/createuser.jsf in Nokia NetAct 22 allows CSRF. A remote attacker is able to create users with arbitrary privileges, even administrative privileges. The application (even if it implements a CSRF token for the random GET request) does not ever verify a CSRF token. With a little help of social engineering/phishing (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.

Weakness: CWE-352

Which versions are affected by CVE-2022-30280?

It affects 1 product.

Products include Nokia Netact.

How do I fix CVE-2022-30280?

No fix has been published for CVE-2022-30280 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-30280 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-30280 exists.

Sources

Also known as GHSA-3qhf-px5p-g68q.