CVE-2020-23451

44th percentile - higher than 44% of all known CVEs

A CSRF vulnerability in Spiceworks version 7.5.00107 and earlier allows an attacker to perform privilege escalation via the /settings/v1/users function. The attack forces an administrator to execute unintended actions, potentially leading to full application compromise.

The risk involves unauthorized privilege escalation by an attacker, which could result in full compromise of the Spiceworks system and access to sensitive organizational data.

Immediately update Spiceworks to the latest available version that fixes this vulnerability. Additionally, implement CSRF protection mechanisms such as anti-CSRF tokens.