Skip to main content

Exacqvision Web Service CVE-2024-32863

HIGH
Cross-Site Request Forgery (CSRF) (CWE-352)
2024-08-01 productsecurity@jci.com
CSRF Exacqvision Web Service
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Aug 01, 2024 - 21:15 nvd
HIGH 8.8

DescriptionNVD

Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF)

AnalysisAI

Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF) Affected products include: Johnsoncontrols Exacqvision Web Service.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.

More in Exacqvision Web Service

View all
CVE-2020-9047 HIGH POC
7.2 Jun 26

A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems runni
CVE-2021-27664 CRITICAL
9.8 Oct 11

Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVisi
CVE-2024-32862 HIGH
8.1 Aug 01

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains.

CVE-2024-32864 HIGH
8.1 Aug 01

Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS). Rated high seve
CVE-2021-27656 HIGH
7.5 Mar 18

A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-le
CVE-2021-27659 MEDIUM
6.1 Jun 24

exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input befo
CVE-2024-32931 MEDIUM
5.7 Aug 01

Under certain circumstances the exacqVision Web Service can expose authentication token details within communications. R

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2017-9757 HIGH POC
8.8
CVE-2013-5696 MEDIUM POC
6.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5
CVE-2020-36836 HIGH POC
8.0

Share

CVE-2024-32863 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy