CVE-2019-17118

HIGH

WiKID 2FA Enterprise Server <= 4.2.0-b2053 - Cross-Site Request Forgery

Title source: llm
STIX 2.1

Description

A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as (1) create or delete admin users; (2) create or delete groups; or (3) create, delete, enable, or disable normal users or devices.

References (4)

Core 4
Core References
Vendor Advisory x_refsource_misc
https://www.securitymetrics.com/blog/
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2019/Oct/35

Scores

CVSS v3 8.8
EPSS 0.0094
EPSS Percentile 56.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (10)
wikidsystems/2fa_enterprise_server 3.4.81 b676
wikidsystems/2fa_enterprise_server 3.4.85 b780
wikidsystems/2fa_enterprise_server 3.4.87 b1092 (6 CPE variants)
wikidsystems/2fa_enterprise_server 3.5.0 b1342 (12 CPE variants)
wikidsystems/2fa_enterprise_server 3.6.0 b1659 (2 CPE variants)
wikidsystems/2fa_enterprise_server 4.0 b1787 (3 CPE variants)
wikidsystems/2fa_enterprise_server 4.0.1 b1817 (4 CPE variants)
wikidsystems/2fa_enterprise_server 4.0.2 b1917 (2 CPE variants)
wikidsystems/2fa_enterprise_server 4.1.0 b1926 (4 CPE variants)
wikidsystems/2fa_enterprise_server 4.2.0 b1978 (12 CPE variants)
Published Oct 17, 2019
Tracked Since Feb 18, 2026