CVE-2022-47559 HIGH

CVE-2022-47559: Cross-Site Request Forgery in Ormazabal products

Vendor Ormazabal
Product ekorCCP
Weakness CWE-352 · CSRF
Published September 19, 2023
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

What the vulnerability does

01Description

Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity.

Key dates

02Disclosure timeline

September 19, 2023 CVE published
August 3, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-34557 WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.5.4 - Cross Site Request Forgery (CSRF) vulnerability CVE-2023-48292 XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks CVE-2022-47178 WordPress Simple Share Buttons Adder Plugin <= 8.4.7 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2022-32516 CVE-2026-7047 Frontend User Notes <= 2.1.1 - Cross-Site Request Forgery to Note Content Modification via 'confirmEdit' Action