CVE-2023-22286

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-22286
Cross-site request forgery (CSRF) vulnerability in MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allows a remote unauthenticated attacker to hijack the user authentication and conduct user's unintended operations by having a user to view a malicious page while logged in.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://jvn.jp/en/jp/JVN99957889/index.html Third Party Advisory
https://www.ate-mahoroba.jp/netdevancer/manual/ Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:ate-mahoroba:maho-pbx_netdevancer_firmware:*:*:*:*:lite:*:*:*
cpe:2.3:h:ate-mahoroba:maho-pbx_netdevancer:-:*:*:*:lite:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:ate-mahoroba:maho-pbx_netdevancer_vsg_firmware:*:*:*:*:lite:*:*:*
cpe:2.3:h:ate-mahoroba:maho-pbx_netdevancer_vsg:-:*:*:*:lite:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:ate-mahoroba:maho-pbx_netdevancer_mobilegate_firmware:*:*:*:*:home:*:*:*
cpe:2.3:h:ate-mahoroba:maho-pbx_netdevancer_mobilegate:-:*:*:*:home:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:ate-mahoroba:maho-pbx_netdevancer_firmware:*:*:*:*:uni:*:*:*
cpe:2.3:h:ate-mahoroba:maho-pbx_netdevancer:-:*:*:*:uni:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:ate-mahoroba:maho-pbx_netdevancer_firmware:*:*:*:*:pro:*:*:*
cpe:2.3:h:ate-mahoroba:maho-pbx_netdevancer:-:*:*:*:pro:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:ate-mahoroba:maho-pbx_netdevancer_firmware:*:*:*:*:cloud:*:*:*
cpe:2.3:h:ate-mahoroba:maho-pbx_netdevancer:-:*:*:*:cloud:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:ate-mahoroba:maho-pbx_netdevancer_vsg_firmware:*:*:*:*:uni:*:*:*
cpe:2.3:h:ate-mahoroba:maho-pbx_netdevancer_vsg:-:*:*:*:uni:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:ate-mahoroba:maho-pbx_netdevancer_mobilegate_firmware:*:*:*:*:office:*:*:*
cpe:2.3:h:ate-mahoroba:maho-pbx_netdevancer_mobilegate:-:*:*:*:office:*:*:*
History

No history.

Information

Published : 2023-01-17 10:15

Updated : 2024-02-28 19:51

NVD link : CVE-2023-22286

Mitre link : CVE-2023-22286

CVE.ORG link : CVE-2023-22286

JSON object : View

Products Affected

ate-mahoroba

  • maho-pbx_netdevancer_mobilegate
  • maho-pbx_netdevancer_firmware
  • maho-pbx_netdevancer
  • maho-pbx_netdevancer_vsg
  • maho-pbx_netdevancer_mobilegate_firmware
  • maho-pbx_netdevancer_vsg_firmware
CWE
CWE-352

Cross-Site Request Forgery (CSRF)