title: Cross Site Request Forgery (CSRF) vulnerability in web based management interface
description: A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
platforms: CPP4, CPP6, AVIOTEC, CPP7, CPP7.3, CPP13, CPP14
product: CPP Firmware
vendor: Bosch
versions:
status: affected, version: all
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]