Vulnerability Description
A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application users) by sending a crafted HTML document or encoded URL to a user that the website trusts. The user needs to have an active privileged session.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| 3Xlogic | Infinias Access Control Firmware | <= 6.6.9586.0 |
| 3Xlogic | Infinias Access Control | - |
Related Weaknesses (CWE)
References
- https://gitlab.com/crypt0crc/cve-2019-18651ExploitThird Party Advisory
- https://gitlab.com/crypt0crc/cve-2019-18651ExploitThird Party Advisory
FAQ
What is CVE-2019-18651?
CVE-2019-18651 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application ...
How severe is CVE-2019-18651?
CVE-2019-18651 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-18651?
Check the references section above for vendor advisories and patch information. Affected products include: 3Xlogic Infinias Access Control Firmware, 3Xlogic Infinias Access Control.