STVS ProVision Cross-Site Request Forgery (Add Admin)

The primary impact of CVE-2021-47723 is the potential for unauthorized administrative account creation. An attacker could craft a malicious website or email containing a forged HTTP request that, when visited by a legitimate administrator, would trigger the creation of a new admin account under the attacker's control. This grants the attacker full administrative privileges within the STVS ProVision system, enabling them to modify configurations, access sensitive data, and potentially compromise the entire environment. The blast radius extends to any data or functionality accessible by an administrator, making this a high-severity concern.

Organizations utilizing STVS ProVision version 5.9.10–5.9.10 are at risk, particularly those where administrative access is not tightly controlled or where users are susceptible to phishing attacks. Shared hosting environments or deployments with weak security awareness training are especially vulnerable.

1. 2025-12-09Disclosure

   disclosure

1. Reserviert2025-12-07
2. Veröffentlicht2025-12-09
3. Geändert2026-04-07
4. EPSS aktualisiert2026-04-12

Without a specific patch available, mitigation focuses on reducing the attack surface and limiting the potential impact. Implement strict input validation on all HTTP requests to ensure that data originates from trusted sources. Employ robust session management techniques, such as requiring re-authentication for sensitive operations. Consider implementing a Content Security Policy (CSP) to restrict the sources from which the browser can load resources, further mitigating the risk of forged requests. Regularly review and audit user access controls to identify and remove any unnecessary privileges.