CVE-2023-4837 Cross-site request forgery (CSRF) in SmodBIP
Cross-site request forgery in SmodBIP allows attackers to force logged-in users to create administrative accounts, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-4837?
CVE-2023-4837 is a high-severity vulnerability in Jan Syski SmodBIP, published on 10 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SmodBIP is vulnerable to Cross-Site Request Forgery, that could be used to induce logged in users to perform unintended actions, including creation of additional accounts with administrative privileges. This issue affects all versions of SmodBIP. SmodBIP is no longer maintained and the vulnerability will not be fixed.
Weakness: CWE-352
Which versions are affected by CVE-2023-4837?
It affects 1 product.
Products include Smod Smodbip.
How do I fix CVE-2023-4837?
No fix has been published for CVE-2023-4837 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-4837 being exploited?
There is no known exploitation of CVE-2023-4837 in the wild and no public exploit code.
Sources
Also known as GHSA-xvf3-52wh-xqx4.