CVE-2023-28718
Assigner: icscert
Published: 2023-03-28T20:09:15.958Z
State: PUBLISHED
title: CVE-2023-28718
descriptions: value: Osprey Pump Controller version 1.01 allows users to perform certain actions via HTTP requests without performing any checks to verify the requests. This may allow an attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.
source: discovery: UNKNOWN
affected: vendor: ProPump and Controls, Inc.
product: Osprey Pump Controller
versions: status: affected
version: 1.01
problemTypes: descriptions: description: CWE-352 Cross-Site Request Forgery (CSRF)
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
baseScore: 7.1
baseSeverity: HIGH
x_generator: engine: VINCE 2.0.7
env: prod
origin: https://cveawg.mitre.org/api/cve/CVE-2023-28718