Description
SnapGear Management Console SG560 version 3.1.5 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft a malicious web page that automatically submits a form to create a new super user account with full administrative privileges when a logged-in user visits the page.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Secure Computing SnapGear Management Console SG560
3.1.5affected
References
- https://www.exploit-db.com/exploits/48554 ↗
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5567.php ↗
- https://packetstorm.news/files/id/157937 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/182969 ↗
- https://www.vulncheck.com/advisories/secure-computing-snapgear-management-console-sg-cross-site-request-forgery-via-admin-users ↗