Osprey Pump Controller version 1.01 allows users to perform certain actions via HTTP requests without performing any checks to verify the requests. This may allow an attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.
References
| Link | Resource |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
| AND |
|
History
05 Apr 2023, 13:09
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.0 |
| First Time |
Propumpservice osprey Pump Controller
Propumpservice osprey Pump Controller Firmware Propumpservice |
|
| References | (MISC) https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06 - Third Party Advisory, US Government Resource | |
| CPE | cpe:2.3:h:propumpservice:osprey_pump_controller:-:*:*:*:*:*:*:* cpe:2.3:o:propumpservice:osprey_pump_controller_firmware:1.01:*:*:*:*:*:*:* |
|
| CWE | CWE-352 |
28 Mar 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-28 21:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-28718
Mitre link : CVE-2023-28718
CVE.ORG link : CVE-2023-28718
JSON object : View
Products Affected
propumpservice
- osprey_pump_controller
- osprey_pump_controller_firmware
CWE
CWE-352
Cross-Site Request Forgery (CSRF)