Advisories

Carlo Gavazzi SmartHouse Webapp 6.5.33 Cross-Site Request Forgery and XSS

Go Back
severity
medium
date
Affecting
  • SmartHouse Webapp 6.5.33

CWE
  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-352 Cross-Site Request Forgery (CSRF)
CVSS
5.1
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Credit
LiquidWorm as Gjoko Krstic of Zero Science Lab
Description
SmartHouse Webapp 6.5.33 contains multiple cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform unauthorized actions. Attackers can exploit these vulnerabilities by tricking logged-in users into visiting malicious websites or injecting malicious scripts into various application parameters.