CVE-2013-3963: grandstream gxv_device_firmware Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2013-3963 is a medium (CVSS 6.8) Cross-Site Request Forgery (CSRF) vulnerability in grandstream gxv_device_firmware. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 60% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-10-2013
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Cross-site request forgery (CSRF) vulnerability in goform/usermanage in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models allows remote attackers to hijack the authentication of unspecified victims for requests that add users.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.