CVE-2023-38885

OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/OS4ED/openSIS-Classic	Release Notes
https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38885	Vendor Advisory
https://www.os4ed.com/	Product
https://github.com/OS4ED/openSIS-Classic	Release Notes
https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38885	Vendor Advisory
https://www.os4ed.com/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:os4ed:opensis:9.0:*:*:*:community:*:*:*

History

21 Nov 2024, 08:14

Type	Values Removed	Values Added
References	~~() https://github.com/OS4ED/openSIS-Classic - Release Notes~~	() https://github.com/OS4ED/openSIS-Classic - Release Notes
References	~~() https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38885 - Vendor Advisory~~	() https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38885 - Vendor Advisory
References	~~() https://www.os4ed.com/ - Product~~	() https://www.os4ed.com/ - Product

30 Nov 2023, 14:23

Type	Values Removed	Values Added
CPE		cpe:2.3:a:os4ed:opensis:9.0::::community:::
CWE		CWE-352
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
References	~~() https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38885 -~~	() https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38885 - Vendor Advisory
References	~~() https://www.os4ed.com/ -~~	() https://www.os4ed.com/ - Product
References	~~() https://github.com/OS4ED/openSIS-Classic -~~	() https://github.com/OS4ED/openSIS-Classic - Release Notes

20 Nov 2023, 19:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-20 19:15

Updated : 2024-11-21 08:14

NVD link : CVE-2023-38885

Mitre link : CVE-2023-38885

CVE.ORG link : CVE-2023-38885

JSON object : View

Products Affected

os4ed

opensis

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2023-38885", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-11-20T19:15:08.820", "references": [{"url": "https://github.com/OS4ED/openSIS-Classic", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38885", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.os4ed.com/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/OS4ED/openSIS-Classic", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38885", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.os4ed.com/", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request."}, {"lang": "es", "value": "OpenSIS Classic Community Edition versi\u00f3n 9.0 carece de protecci\u00f3n contra ataques de Cross-Site Request Forgery (CSRF) en toda la aplicaci\u00f3n. Esto puede permitir a un atacante enga\u00f1ar a un usuario autenticado para que realice cualquier tipo de solicitud de cambio de estado."}], "lastModified": "2024-11-21T08:14:21.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:os4ed:opensis:9.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "31C122B7-1057-40D8-B883-8C41776AA826"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}