Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an unprivileged remote user is able to create, delete and modify users within theapplication.
References
Link | Resource |
---|---|
https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-request-forgery-free5gc | Third Party Advisory |
Configurations
History
04 Oct 2023, 17:01
Type | Values Removed | Values Added |
---|---|---|
First Time |
Free5gc free5gc
Free5gc |
|
CWE | CWE-352 | |
CPE | cpe:2.3:a:free5gc:free5gc:1.1.1:*:*:*:*:*:*:* | |
References | (MISC) https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-request-forgery-free5gc - Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
02 Oct 2023, 15:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-10-02 15:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-4659
Mitre link : CVE-2023-4659
CVE.ORG link : CVE-2023-4659
JSON object : View
Products Affected
free5gc
- free5gc
CWE
CWE-352
Cross-Site Request Forgery (CSRF)