An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user (such as operator) can be used to confirm actions of higher-privileged ones (such as xpadmin).
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2022-03-13T01:30:07
Updated: 2024-08-04T04:54:30.593Z
Reserved: 2021-12-27T00:00:00
Link: CVE-2021-45886
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-03-13T02:15:07.123
Modified: 2024-11-21T06:33:11.773
Link: CVE-2021-45886
Redhat
No data.