CVE-2019-10253

· MEDIUMModified

← All CVEs

CVSS v3.1

6.5

EPSS

0.66%

Published

Sep 9, 2019

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upload malicious/forged files on a TeamMate server, or replace existing uploaded files with malicious/forged files). The specific flaw exists within the handling of Upload/DomainObjectDocumentUpload.ashx requests because of failure to validate a CSRF token before handling a POST request.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-352

Affected Products (1)

teammatesolutions · teammate\+vulnerable

References (4)

http://packetstormsecurity.com/files/154294/Wolters-Kluwer-TeamMate-3.1-Cross-Site-Request-Forgery.html

ExploitThird Party AdvisoryVDB Entry

http://www.teammatesolutions.com/

Vendor Advisory

http://packetstormsecurity.com/files/154294/Wolters-Kluwer-TeamMate-3.1-Cross-Site-Request-Forgery.html

ExploitThird Party AdvisoryVDB Entry

http://www.teammatesolutions.com/

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs