CSRF in Ncratleos Terminal Handler
CVE-2023-47020
Multiple Cross-Site Request Forgery (CSRF) chaining in NCR Terminal Handler v.1.5.1 allows privileges to be escalated by an attacker through a crafted request involving user account creation and adding the user to an administrator group. This is exploited by an undisclosed function in the WSDL that lacks security controls and can accept custom content types.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.003 (27.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Ncratleos Terminal_handler — versions 1.5.1
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit)
- cve@mitre.org (Third Party Advisory)
Frequently asked questions
- What is CVE-2023-47020?
- CVE-2023-47020 is a high-severity vulnerability in Ncratleos Terminal Handler, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2024-02-08.
- How severe is CVE-2023-47020?
- High severity. CVSS v3 base score is 8.8 out of 10.