Vulnerability · Published Oct 10, 2023 · Assigned by CERT-PL

CVE-2023-4837Cross-site request forgery (CSRF) in SmodBIP

High 8.8

In plain English

A high-severity cross-site request forgery in SmodBIP from Jan Syski. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 67.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SmodBIP is vulnerable to Cross-Site Request Forgery, that could be used to induce logged in users to perform unintended actions, including creation of additional accounts with administrative privileges. This issue affects all versions of SmodBIP. SmodBIP is no longer maintained and the vulnerability will not be fixed.

Affected products (as reported)

Vendor	Product	Versions
Jan Syski	SmodBIP	0 – before *

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://cert.pl/posts/2023/10/CVE-2023-4837/ third-party-advisory
https://cert.pl/en/posts/2023/10/CVE-2023-4837/ third-party-advisory
https://smod.pl/ product