CVE-2024-3142

Clavister E10/E80 Setting cross-site request forgery

State: Published
Severity: 4.3 Medium
Published: Apr 2, 2024
Updated: Aug 28, 2024
Reserved: Apr 1, 2024

Description

A vulnerability was found in Clavister E10 and E80 up to 14.00.10 and classified as problematic. This issue affects some unknown processing of the component Setting Handler. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 14.00.11 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-258917 was assigned to this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:P/A:N	VulDB

Weaknesses

CWE-352 Cross-Site Request Forgery

Affected Products

Product	Versions
E10Clavister	14.00.0Affected 14.00.1Affected 14.00.2Affected 14.00.3Affected 14.00.4Affected 14.00.5Affected 14.00.6Affected 14.00.7Affected 14.00.8Affected 14.00.9Affected 14.00.10Affected
E80Clavister	14.00.0Affected 14.00.1Affected 14.00.2Affected 14.00.3Affected 14.00.4Affected 14.00.5Affected 14.00.6Affected 14.00.7Affected 14.00.8Affected 14.00.9Affected 14.00.10Affected

References

VDB-258917 | Clavister E10/E80 Setting cross-site request forgeryvdb-entry
VDB-258917 | CTI Indicators (IOB, IOC)signaturepermissions-required
Submit #303530 | Clavister Clavister E10,E80 - EagleSeries . Cross-Site Request Forgery (CSRF)third-party-advisory
https://github.com/strik3r0x1/Vulns/blob/main/CSRF_Clavister-E80,E10.mdexploit
https://docs.clavister.com/repo/cos-core-release-notes/doc/index.html#d0e2260related
https://my.clavister.com/downloads/?sid=1patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.