CVE-2024-20347: CSRF
A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a CSRF attack, which could allow the attacker to perform arbitrary actions on an affected device. This vulnerability is due to insufficient protections for the web UI of an affected system. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user, such as deleting users from the device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20347?
CVE-2024-20347 has been assigned a medium severity rating due to its potential to allow CSRF attacks on affected systems.
How do I fix CVE-2024-20347?
To mitigate CVE-2024-20347, ensure that all known patches and updates for Cisco Emergency Responder are applied as per Cisco's security advisory guidance.
What type of attack does CVE-2024-20347 facilitate?
CVE-2024-20347 facilitates Cross-Site Request Forgery (CSRF) attacks that can enable unauthorized actions on the web UI of Cisco Emergency Responder.
Which systems are affected by CVE-2024-20347?
CVE-2024-20347 affects systems running Cisco Emergency Responder that do not have proper protections against CSRF.
Who can exploit CVE-2024-20347?
CVE-2024-20347 can be exploited by unauthenticated remote attackers who are able to create a CSRF attack targeted at affected devices.