CVE-2022-3585: oretnom23 simple_cold_storage_management_system Incorrect Authorization

Vulnerability summary

CVE-2022-3585 is a medium (CVSS 4.3) Incorrect Authorization vulnerability in oretnom23 simple_cold_storage_management_system. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-10-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability classified as problematic has been found in SourceCodester Simple Cold Storage Management System 1.0. Affected is an unknown function of the file /csms/?page=contact_us of the component Contact Us. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-211194 is the identifier assigned to this vulnerability.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.