{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-47723", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-12-07T14:25:05.584Z", "datePublished": "2025-12-09T20:41:56.364Z", "dateUpdated": "2025-12-12T16:33:04.402Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "STVS ProVision", "vendor": "STVS SA", "versions": [{"status": "affected", "version": "5.9.10 (build 2885-3a8219a)"}]}], "credits": [{"lang": "en", "type": "finder", "value": "LiquidWorm as Gjoko Krstic of Zero Science Lab"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users.</p>"}], "value": "STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-12-09T20:41:56.364Z"}, "references": [{"name": "ExploitDB-49482", "tags": ["exploit"], "url": "https://www.exploit-db.com/exploits/49482"}, {"name": "STVS SA Homepage", "tags": ["product"], "url": "http://www.stvs.ch"}, {"name": "Zero Science Lab Disclosure (ZSL-2021-5625)", "tags": ["third-party-advisory"], "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5625.php"}, {"name": "VulnCheck Advisory: STVS ProVision Cross-Site Request Forgery (Add Admin)", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/stvs-provision-cross-site-request-forgery-add-admin"}], "source": {"discovery": "UNKNOWN"}, "title": "STVS ProVision Cross-Site Request Forgery (Add Admin)", "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-12T16:32:56.370910Z", "id": "CVE-2021-47723", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T16:33:04.402Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47723", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T16:32:56.370910Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T16:32:59.640Z"}}], "cna": {"title": "STVS ProVision Cross-Site Request Forgery (Add Admin)", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "LiquidWorm as Gjoko Krstic of Zero Science Lab"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "STVS SA", "product": "STVS ProVision", "versions": [{"status": "affected", "version": "5.9.10 (build 2885-3a8219a)"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.exploit-db.com/exploits/49482", "name": "ExploitDB-49482", "tags": ["exploit"]}, {"url": "http://www.stvs.ch", "name": "STVS SA Homepage", "tags": ["product"]}, {"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5625.php", "name": "Zero Science Lab Disclosure (ZSL-2021-5625)", "tags": ["third-party-advisory"]}, {"url": "https://www.vulncheck.com/advisories/stvs-provision-cross-site-request-forgery-add-admin", "name": "VulnCheck Advisory: STVS ProVision Cross-Site Request Forgery (Add Admin)", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users.", "supportingMedia": [{"type": "text/html", "value": "<p>STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-12-09T20:41:56.364Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47723", "state": "PUBLISHED", "dateUpdated": "2025-12-12T16:33:04.402Z", "dateReserved": "2025-12-07T14:25:05.584Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-12-09T20:41:56.364Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:stvs:provision:5.5:*:*:*:*:*:*:*", "matchCriteriaId": "5C0F2D09-CDB3-4DAA-8C6A-1CFF4B5D2AF2", "vulnerable": true}, {"criteria": "cpe:2.3:a:stvs:provision:5.6:*:*:*:*:*:*:*", "matchCriteriaId": "C75EA53C-2681-479C-B911-7CE5AEE00E69", "vulnerable": true}, {"criteria": "cpe:2.3:a:stvs:provision:5.7:*:*:*:*:*:*:*", "matchCriteriaId": "A5EDCA0E-E4BF-4D4A-92D7-7433CC23A9EC", "vulnerable": true}, {"criteria": "cpe:2.3:a:stvs:provision:5.8.6:*:*:*:*:*:*:*", "matchCriteriaId": "21131E39-42C6-43BC-8C53-7D4036D3B3AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:stvs:provision:5.9.0:*:*:*:*:*:*:*", "matchCriteriaId": "807E2E4F-85FB-46AD-8ABF-12ECBF30047C", "vulnerable": true}, {"criteria": "cpe:2.3:a:stvs:provision:5.9.1:*:*:*:*:*:*:*", "matchCriteriaId": "5AC87B35-CCF1-43B8-9DB4-8C7D2BEF51FA", "vulnerable": true}, {"criteria": "cpe:2.3:a:stvs:provision:5.9.7:*:*:*:*:*:*:*", "matchCriteriaId": "83FEE9FC-3E43-47F1-BA35-2BB7C7DAA443", "vulnerable": true}, {"criteria": "cpe:2.3:a:stvs:provision:5.9.9:*:*:*:*:*:*:*", "matchCriteriaId": "D8BE45C5-7BD9-4853-99C9-D8969EB8FC94", "vulnerable": true}, {"criteria": "cpe:2.3:a:stvs:provision:5.9.10:*:*:*:*:*:*:*", "matchCriteriaId": "495B9F3E-DD0F-4010-AE20-1A763AF04D7C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users."}], "id": "CVE-2021-47723", "lastModified": "2026-02-17T20:36:44.613", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2025-12-09T21:15:50.770", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "http://www.stvs.ch"}, {"source": "disclosure@vulncheck.com", "tags": ["Technical Description"], "url": "https://www.exploit-db.com/exploits/49482"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/stvs-provision-cross-site-request-forgery-add-admin"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5625.php"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{}

{"created": "2025-12-10T21:33:23.528404+00:00", "updated": "2025-12-10T21:33:23.528440+00:00", "vendors": ["stvs", "stvs$PRODUCT$provision"]}