CVE-2024-37774
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A CSRF vulnerability in Sunbird DCIM dcTrack version 9.1.2 allows authenticated attackers to escalate privileges by forcing an administrator to perform sensitive requests on certain admin screens.
Risk Assessment
The risk is that an attacker can hijack an administrator account and perform unauthorized operations, potentially compromising the integrity and confidentiality of data in the data center infrastructure management system.
Recommendation
It is recommended to immediately update to the latest version of Sunbird DCIM dcTrack and implement CSRF protection mechanisms such as anti-CSRF tokens and Origin header validation.
Other vulnerabilities in Sunbird DCIM dcTrack
See all- CVE-2024-37776Medium
A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to inject malicious scripts or HTML on certain admin screens.
- CVE-2024-37775High
In Sunbird DCIM dcTrack version 9.1.2, incorrect access control allows attackers to create or update tickets with a location that bypasses an RBAC check.
- CVE-2024-37773Medium
An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows authenticated attackers with administrator privileges to inject arbitrary HTML code in an admin screen.
Original NVD description (English source)
A Cross-Site Request Forgery (CSRF) in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers to escalate their privileges by forcing an Administrator user to perform sensitive requests in some admin screens.