CVE-2018-5329: CSRF
ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) on /CWEBNET/ authenticated pages. A successful CSRF attack can force the user to modify state: creating users, changing an email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5329?
CVE-2018-5329 is considered a high severity vulnerability due to the impact it can have on authenticated user sessions.
How do I fix CVE-2018-5329?
To fix CVE-2018-5329, implement CSRF protection measures such as anti-CSRF tokens in your application.
What are the consequences of CVE-2018-5329?
The consequences of CVE-2018-5329 include unauthorized actions such as creating users or modifying email addresses if an attacker exploits an authenticated session.
Who is affected by CVE-2018-5329?
CVE-2018-5329 affects users of ZUUSE BEIMS ContractorWeb version 5.18.0.0 on authenticated pages.
Is authentication necessary to exploit CVE-2018-5329?
No, while the user must be authenticated, the exploitation of CVE-2018-5329 can be carried out by sending a crafted request to the vulnerable actions.