CVE-2020-24983 - CVE House
Back to Database
Status published High CVE-2020-24983

An issue was discovered in Quadbase EspressReports ES 7 Update...

Vulnerability Description

An issue was discovered in Quadbase EspressReports ES 7 Update 9. An unauthenticated attacker can create a malicious HTML file that houses a POST request made to the DashboardBuilder within the target web application. This request will utilise the target admin session and perform the authenticated request (to change the Dashboard name) as if the victim had done so themselves, aka CSRF.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-24983

Credits & Attribution

No credits recorded in the NVD database.

References

More from quadbase

View All →
CVE-2020-24985
An issue was discovered in Quadbase EspressReports ES 7 Update...
High 8.1
CVE-2020-24984
An issue was discovered in Quadbase EspressReports ES 7 Update...
High 8.8
CVE-2020-24982
An issue was discovered in Quadbase ExpressDashboard (EDAB) 7 Update...
Medium 4.3
CVE-2019-9958
CSRF within the admin panel in Quadbase EspressReport ES (ERES)...
High 8.8
CVE-2019-9957
Stored XSS within Quadbase EspressReport ES (ERES) v7.0 update 7...
Medium 5.4

Affected Vendor

Affected Software

espressreports es
Vulnerable Versions:
7

Timeline

Official Publish: March 11th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.