CVE-2022-30280: CSRF
First published: Mon Jul 24 2023(Updated: )
/SecurityManagement/html/createuser.jsf in Nokia NetAct 22 allows CSRF. A remote attacker is able to create users with arbitrary privileges, even administrative privileges. The application (even if it implements a CSRF token for the random GET request) does not ever verify a CSRF token. With a little help of social engineering/phishing (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nokia NetAct | =22.0.0.62 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-30280.
What is the severity of CVE-2022-30280?
CVE-2022-30280 has a severity rating of 8.8 (high).
How does CVE-2022-30280 affect Nokia NetAct?
CVE-2022-30280 affects Nokia NetAct version 22.0.0.62.
What is the impact of CVE-2022-30280?
CVE-2022-30280 allows a remote attacker to create users with arbitrary privileges, including administrative privileges.
Is there a fix available for CVE-2022-30280?
At the time of writing, there is no specific fix available for CVE-2022-30280. It is recommended to apply any patches or updates provided by the vendor.
- collector/nvd-latest
- collector/nvd-index
- agent/references
- agent/author
- agent/type
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/description
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- vendor/nokia
- canonical/nokia netact
- version/nokia netact/22.0.0.62