What’s Vulnerable › Vulnerabilities

CVE-2023-47020

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-02-08 · updated 2026-06-17
• Weakness: CWE-352

Description

Multiple Cross-Site Request Forgery (CSRF) chaining in NCR Terminal Handler v.1.5.1 allows privileges to be escalated by an attacker through a crafted request involving user account creation and adding the user to an administrator group. This is exploited by an undisclosed function in the WSDL that lacks security controls and can accept custom content types.

Affected products

• Ncratleos Terminal Handler: 1.5.1

References

• https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47020
• https://youtu.be/pGB3LKdf64w
• https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47020
• https://youtu.be/pGB3LKdf64w

Get alerted when CVE-2023-47020 or the next vulnerability affects your stack