{"id":"CVE-2023-38579","state":"PUBLISHED","title":"Westermo Lynx 206-F2G Cross-Site Request Forgery","description":"\n\n\n\n\n\n\n\n\n\n\n\n\nThe cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which could be triggered by a victim unknowingly. In a successful CSRF attack, the attacker could lead the victim user to carry out an action unintentionally.\n\n\n\n\n\n","publishedAt":"2024-02-06T21:16:48.926Z","updatedAt":"2024-11-07T20:33:42.806Z","severity":{"score":8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","source":"icscert"},"assigner":"icscert","products":["Westermo Lynx"],"affected":[{"vendor":"Westermo","product":"Lynx","defaultStatus":"unaffected","versions":[{"version":"L206-F2G1","status":"affected"},{"version":"4.24","status":"affected"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-04"],"weaknesses":["CWE-352"],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/38xxx/CVE-2023-38579.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-38579","state":"PUBLISHED","datePublished":"2024-02-06T21:16:48.926Z","dateUpdated":"2024-11-07T20:33:42.806Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2023-10-12T20:21:27.767Z"},"containers":{"cna":{"title":"Westermo Lynx 206-F2G Cross-Site Request Forgery","descriptions":[{"lang":"en","value":"\n\n\n\n\n\n\n\n\n\n\n\n\nThe cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which could be triggered by a victim unknowingly. In a successful CSRF attack, the attacker could lead the victim user to carry out an action unintentionally.\n\n\n\n\n\n"}],"affected":[{"vendor":"Westermo","product":"Lynx","defaultStatus":"unaffected","versions":[{"version":"L206-F2G1","status":"affected"},{"version":"4.24","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-04"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","description":"CWE-352 Cross-Site Request Forgery","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2024-02-06T21:16:48.926Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Aarón Flecha Menéndez, Iván Alonso Álvarez and Víctor Bello Cuevas reported these vulnerabilities to CISA."}],"datePublic":"2024-01-23T21:16:00.000Z","source":{"discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"\n\n<p>Westermo recommends following best practices for hardening, such as restricting access, disable unused services (attack surface reduction), etc., to mitigate the reported vulnerabilities.&nbsp;&nbsp;<span style=\"background-color: var(--wht);\">The reported cross site request forgery vulnerability was patched in a later WeOS4 version.</span></p>\n\n<br>"}],"value":"\nWestermo recommends following best practices for hardening, such as restricting access, disable unused services (attack surface reduction), etc., to mitigate the reported vulnerabilities.  The reported cross site request forgery vulnerability was patched in a later WeOS4 version.\n\n\n\n\n"}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-04","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T17:46:56.268Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-02-07T19:44:11.991190Z","id":"CVE-2023-38579","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-07T20:33:42.806Z"}}]}}}