CVE-2023-47020

HIGH

NCR Terminal Handler 1.5.1 - Cross-Site Request Forgery via WSDL Function

Title source: llm
STIX 2.1

Description

Multiple Cross-Site Request Forgery (CSRF) chaining in NCR Terminal Handler v.1.5.1 allows privileges to be escalated by an attacker through a crafted request involving user account creation and adding the user to an administrator group. This is exploited by an undisclosed function in the WSDL that lacks security controls and can accept custom content types.

References (2)

Core 2

Scores

CVSS v3 8.8
EPSS 0.0035
EPSS Percentile 26.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (1)
ncratleos/terminal_handler 1.5.1
Published Feb 08, 2024
Tracked Since Feb 18, 2026