cnvd-2021-24901

fkie_cve-2020-11682

GHSA-gxxf-h2fp-mgxp

VAR-202006-0045

Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A __RequestVerificationToken is set by the web interface, and included in requests sent by web interface. However, this token is not verified by the application: the token can be removed from all requests and the request will succeed. The vulnerability stems from the fact that the WEB application does not fully verify whether the request comes from a trusted user. An attacker can use this vulnerability to send unexpected requests to the server through the affected client. All issues are associated with *Castel NextGen DVR v1.0.0 *and have been resolved in v1.0.1*.*

------------------------------- *CVE-2020-11679 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11679>*

*Original Disclosure* https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass

*Description* A low privileged user can call functionality reserved for an Administrator which promotes a low privileged account to the Administrator role:

POST /Administration/Users/Edit/:ID HTTP/1.1 > Host: $RHOST > User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 > Firefox/52.0 > Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 > Accept-Language: en-US,en;q=0.5 > Accept-Encoding: gzip, deflate > Cookie: $REVIEWER_COOKIES > DNT: 1 > Connection: close > Upgrade-Insecure-Requests: 1 > Content-Type: application/x-www-form-urlencoded > Content-Length: 349

> UserId=:ID&Email=byp…

Most recent entries from all

cnvd-2021-24901

fkie_cve-2020-11682

GHSA-gxxf-h2fp-mgxp

gsd-2020-11682

VAR-202006-0045