CVE-2023-47024

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross-Site Request Forgery (CSRF) in NCR Terminal Handler v.1.5.1 leads to a one-click account takeover. This is achieved by exploiting multiple vulnerabilities, including an undisclosed function in the WSDL that has weak security controls and can accept custom content types.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.google.com/document/d/18EOsFghBsAme0b3Obur8Oc6h5xV9zUCNKyQLw5ERs9Q/edit?usp=sharingPermissions Required
https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47024Third Party Advisory
https://docs.google.com/document/d/18EOsFghBsAme0b3Obur8Oc6h5xV9zUCNKyQLw5ERs9Q/edit?usp=sharingPermissions Required
https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47024Third Party Advisory

Timeline

Published: Jan 20, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-470255.5An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component.CVE-2023-470299.8An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted P CVE-2023-47037.5The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing CVE-2023-470309.8An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a GET reque CVE-2023-470319.8An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to escalate privileges via a crafted POST request to the grantRolesToUsers CVE-2023-470329.8Password Vulnerability in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the UserSe CVE-2023-470337.5MultiSigWallet 0xF0C99 was discovered to contain a reentrancy vulnerability via the function executeTransaction.CVE-2023-470347.5A vulnerability in UniswapFrontRunBot 0xdB94c allows attackers to cause financial losses via unspecified vectors.CVE-2023-470357.5RPTC 0x3b08c was discovered to not conduct status checks on the parameter tradingOpen. This vulnerability can allow attackers to conduct una CVE-2023-470374.3We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affe CVE-2023-470387.8A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can CVE-2023-470397.8A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find