1. Home
  2. CVE Database
  3. CVE-2023-4659
CRITICAL · 9.8

CVE-2023-4659

Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It...

Vulnerability Description

Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an unprivileged remote user is able to create, delete and modify users within theapplication.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Free5GcFree5Gc1.1.1

Related Weaknesses (CWE)

CWE-352

References

FAQ

What is CVE-2023-4659?

CVE-2023-4659 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It...

How severe is CVE-2023-4659?

CVE-2023-4659 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2023-4659?

Check the references section above for vendor advisories and patch information. Affected products include: Free5Gc Free5Gc.