CVE-2024-28141

Description

The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the admin password or create new users.

Reserved 2024-03-05 | Published 2024-12-11 | Updated 2024-12-11 | Assigner SEC-VLab

Problem types

CWE-352 Cross-Site Request Forgery (CSRF)

Product status

Default status
affected

Any version before 7.40
affected

Credits

Daniel Hirschberger (SEC Consult Vulnerability Lab) finder

Tobias Niemann (SEC Consult Vulnerability Lab) finder

References

r.sec-consult.com/imageaccess third-party-advisory

www.imageaccess.de/?page=SupportPortal&lang=en patch

cve.org (CVE-2024-28141)

nvd.nist.gov (CVE-2024-28141)

Download JSON