CVE-2023-47020

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

M

ultiple Cross-Site Request Forgery (CSRF) chaining in NCR Terminal Handler v.1.5.1 allows privileges to be escalated by an attacker through a crafted request involving user account creation and adding the user to an administrator group. This is exploited by an undisclosed function in the WSDL that lacks security controls and can accept custom content types.

References

Link	Resource
https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47020	Third Party Advisory
https://youtu.be/pGB3LKdf64w	Exploit
https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47020	Third Party Advisory
https://youtu.be/pGB3LKdf64w	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:ncratleos:terminal_handler:1.5.1:*:*:*:*:*:*:*

History

21 Nov 2024, 08:29

Type	Values Removed	Values Added
References	~~() https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47020 - Third Party Advisory~~	() https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47020 - Third Party Advisory
References	~~() https://youtu.be/pGB3LKdf64w - Exploit~~	() https://youtu.be/pGB3LKdf64w - Exploit

Information

Published : 2024-02-08 16:15

Updated : 2025-06-10 16:15

NVD link : CVE-2023-47020

Mitre link : CVE-2023-47020

CVE.ORG link : CVE-2023-47020

JSON object : View

Products Affected

terminal_handler

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2023-47020", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-02-08T16:15:46.377", "references": [{"url": "https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47020", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://youtu.be/pGB3LKdf64w", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47020", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://youtu.be/pGB3LKdf64w", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-352"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Multiple Cross-Site Request Forgery (CSRF) chaining in NCR Terminal Handler v.1.5.1 allows privileges to be escalated by an attacker through a crafted request involving user account creation and adding the user to an administrator group. This is exploited by an undisclosed function in the WSDL that lacks security controls and can accept custom content types."}, {"lang": "es", "value": "El encadenamiento de Multiple Cross-Site Request Forgery (CSRF) en NCR Terminal Handler v.1.5.1 permite que un atacante aumente los privilegios a trav\u00e9s de una solicitud manipulada que implica la creaci\u00f3n de una cuenta de usuario y la adici\u00f3n del usuario a un grupo de administradores. Esto es aprovechado por una funci\u00f3n no revelada en el WSDL que carece de controles de seguridad y puede aceptar tipos de contenido personalizados."}], "lastModified": "2025-06-10T16:15:34.370", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ncratleos:terminal_handler:1.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7CBF0BA-23C2-4A14-9D14-2CF59375C880"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}