CVE-2023-47022 — MEDIUM (6.5)

Vulnerability Description

Insecure Direct Object Reference in NCR Terminal Handler v.1.5.1 allows an unprivileged user to edit the audit logs for any user and can lead to CSV injection.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Ncr	Terminal Handler	1.5.1

Related Weaknesses (CWE)

CWE-639 CWE-1236

References

https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47022Third Party Advisory
https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47022Third Party Advisory

FAQ

What is CVE-2023-47022?

CVE-2023-47022 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Insecure Direct Object Reference in NCR Terminal Handler v.1.5.1 allows an unprivileged user to edit the audit logs for any user and can lead to CSV injection.

How severe is CVE-2023-47022?

CVE-2023-47022 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-47022?

Check the references section above for vendor advisories and patch information. Affected products include: Ncr Terminal Handler.