CVE-2023-2746

CRITICAL Year: 2023
CVSS v3 Score
9.6
Critical
Weakness Type
CWE-352
View all →

Vulnerability Description

The Rockwell Automation Enhanced HIM software contains an API that the application uses that is not protected sufficiently and uses incorrect Cross-Origin Resource Sharing (CORS) settings and, as a result, is vulnerable to a Cross Site Request Forgery (CSRF) attack. To exploit this vulnerability, a malicious user would have to convince a user to click on an untrusted link through a social engineering attack or successfully perform a Cross Site Scripting Attack (XSS). Exploitation of a CSRF could potentially lead to sensitive information disclosure and full remote access to the affected products.

Related Vulnerabilities

CVE-2016-6637

CRITICAL
CVSS:9.6(Critical)

Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x ...

CWE-3522016

CVE-2019-10784

CRITICAL
CVSS:9.6(Critical)

phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "database.php" does not verify the source of an H...

CWE-3522019

CVE-2020-12076

CRITICAL
CVSS:9.6(Critical)

The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS.

CWE-3522020

CVE-2020-6167

CRITICAL
CVSS:9.6(Critical)

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote f...

CWE-3522020

CVE-2021-25010

CRITICAL
CVSS:9.6(Critical)

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are...

CWE-3522021

CVE-2023-37277

CRITICAL
CVSS:9.6(Critical)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The REST API allows executing all actions via POST requests and accepts `text/plain`, `multipar...

CWE-3522023