CVE-2017-16756

EUVD-2017-7939
An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.change" endpoint. This allows an attacker to change the password of another user's HelpSpot account.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 40%
Affected Products (NVD)
VendorProductVersion
userscapehelpspot
𝑥
≤ 4.7.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://ruby.sh/helpspot-disclosure-20180206.txt
https://www.helpspot.com/releases
https://www.helpspot.com/releases/version-4-7-2
https://ruby.sh/helpspot-disclosure-20180206.txt
https://www.helpspot.com/releases
https://www.helpspot.com/releases/version-4-7-2