CVE-2021-47702 MEDIUM

CVE-2021-47702: OpenBMCS Cross Site Request Forgery (CSRF) via sendFeedback.php

Vendor Open Bmcs
Product OpenBMCS
Weakness CWE-352 · CSRF
Published December 9, 2025
Last update April 7, 2026

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenBMCS 2.4 contains a CSRF vulnerability that allows attackers to perform actions with administrative privileges by exploiting the sendFeedback.php endpoint. Attackers can submit malicious requests to trigger unintended actions, such as sending emails or modifying system settings.

Key dates

02Disclosure timeline

December 9, 2025 CVE published
April 7, 2026 Record updated