CVE-2021-47723 | THREATINT

Description

STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users.

PUBLISHED Reserved 2025-12-07 | Published 2025-12-09 | Updated 2025-12-12 | Assigner VulnCheck

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-352: Cross-Site Request Forgery (CSRF)

Product status

Default status

unaffected

5.9.10 (build 2885-3a8219a)

affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.exploit-db.com/exploits/49482 (ExploitDB-49482) exploit

www.stvs.ch (STVS SA Homepage) product

www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5625.php (Zero Science Lab Disclosure (ZSL-2021-5625)) third-party-advisory

www.vulncheck.com/...on-cross-site-request-forgery-add-admin (VulnCheck Advisory: STVS ProVision Cross-Site Request Forgery (Add Admin)) third-party-advisory

cve.org (CVE-2021-47723)

nvd.nist.gov (CVE-2021-47723)

Download JSON