CVE-2023-47020

HIGH 8.8CVE-2023-47020 · Published 08/02/2024 · updated 17/06/2026

In short

CVE-2023-47020 is a HIGH (CVSS 8.8) vulnerability affecting terminal handler (ncratleos).
Chance of exploitation in the next 30 days (EPSS): 0.35%, higher than 28.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
terminal handler ncratleos	`= 1.5.1`	No fix yet

Description

Multiple Cross-Site Request Forgery (CSRF) chaining in NCR Terminal Handler v.1.5.1 allows privileges to be escalated by an attacker through a crafted request involving user account creation and adding the user to an administrator group. This is exploited by an undisclosed function in the WSDL that lacks security controls and can accept custom content types.

References

Patrick0x41/Security-Advisories · Third Party Advisory
youtu.be/pGB3LKdf64w · Exploit

More vulnerabilities in terminal handler

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free