« Volver al listado

CVE-2021-47723

Estado: AnalizadaMedia (6.9)—

STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Stvs — Provision

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-47723",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-47723",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-12T16:32:56.370910Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "ACTIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "STVS SA",
          "product": "STVS ProVision",
          "versions": [
            {
              "status": "affected",
              "version": "5.9.10 (build 2885-3a8219a)"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-12-09T21:15:50.770",
  "references": [
    {
      "url": "http://www.stvs.ch",
      "tags": [
        "Product"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/49482",
      "tags": [
        "Technical Description"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/stvs-provision-cross-site-request-forgery-add-admin",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5625.php",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users."
    }
  ],
  "lastModified": "2026-06-17T04:18:21.847",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:stvs:provision:5.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C0F2D09-CDB3-4DAA-8C6A-1CFF4B5D2AF2"
            },
            {
              "criteria": "cpe:2.3:a:stvs:provision:5.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C75EA53C-2681-479C-B911-7CE5AEE00E69"
            },
            {
              "criteria": "cpe:2.3:a:stvs:provision:5.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5EDCA0E-E4BF-4D4A-92D7-7433CC23A9EC"
            },
            {
              "criteria": "cpe:2.3:a:stvs:provision:5.8.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21131E39-42C6-43BC-8C53-7D4036D3B3AE"
            },
            {
              "criteria": "cpe:2.3:a:stvs:provision:5.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "807E2E4F-85FB-46AD-8ABF-12ECBF30047C"
            },
            {
              "criteria": "cpe:2.3:a:stvs:provision:5.9.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AC87B35-CCF1-43B8-9DB4-8C7D2BEF51FA"
            },
            {
              "criteria": "cpe:2.3:a:stvs:provision:5.9.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83FEE9FC-3E43-47F1-BA35-2BB7C7DAA443"
            },
            {
              "criteria": "cpe:2.3:a:stvs:provision:5.9.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8BE45C5-7BD9-4853-99C9-D8969EB8FC94"
            },
            {
              "criteria": "cpe:2.3:a:stvs:provision:5.9.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "495B9F3E-DD0F-4010-AE20-1A763AF04D7C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com"
}