Cross-site request forgery in Booking calendar, Appointment Booking System - CVE-2018-5673

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU19680

Cross-site request forgery in Booking calendar, Appointment Booking System - CVE-2018-5673

Published: August 2, 2019


Vulnerability identifier: #VU19680
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-5673
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.


Affected software

Booking calendar, Appointment Booking System
IBM Cloud Pak for Business Automation

How to mitigate CVE-2018-5673

Update to version 2.1.8.

Booking calendar, Appointment Booking System - update to 2.1.8
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.11, 22.0.1.1

External References

Related Security Bulletins