CVE-2021-47723: XSRF in STVS ProVision 5.9.10

The primary impact of CVE-2021-47723 is the potential for unauthorized administrative account creation. An attacker could craft a malicious website or email containing a forged HTTP request that, when visited by a legitimate administrator, would trigger the creation of a new admin account under the attacker's control. This grants the attacker full administrative privileges within the STVS ProVision system, enabling them to modify configurations, access sensitive data, and potentially compromise the entire environment. The blast radius extends to any data or functionality accessible by an administrator, making this a high-severity concern.

1. Reserved2025-12-07
2. Published2025-12-09
3. Modified2026-04-07
4. EPSS updated2026-04-12

Without a specific patch available, mitigation focuses on reducing the attack surface and limiting the potential impact. Implement strict input validation on all HTTP requests to ensure that data originates from trusted sources. Employ robust session management techniques, such as requiring re-authentication for sensitive operations. Consider implementing a Content Security Policy (CSP) to restrict the sources from which the browser can load resources, further mitigating the risk of forged requests. Regularly review and audit user access controls to identify and remove any unnecessary privileges.