CVE-2022-30280

/SecurityManagement/html/createuser.jsf in Nokia NetAct 22 allows CSRF. A remote attacker is able to create users with arbitrary privileges, even administrative privileges. The application (even if it implements a CSRF token for the random GET request) does not ever verify a CSRF token. With a little help of social engineering/phishing (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.

• CWE-352

• https://www.gruppotim.it/it/footer/red-team.htmlExploit, Third Party Advisory
• https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.htmlNot Applicable
• https://www.gruppotim.it/it/footer/red-team.htmlExploit, Third Party Advisory
• https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.htmlNot Applicable

Published

Jul 24, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30275The Motorola MOSCAD Toolbox software through 2022-05-02 reli…7.5
• CVE-2022-30276The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 …7.5
• CVE-2022-30277BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an …5.7
• CVE-2022-30278A vulnerability in Black Duck Hub’s embedded MadCap Flare do…6.1
• CVE-2022-30279An issue was discovered in Stormshield Network Security (SNS…7.5
• CVE-2022-3028A race condition was found in the Linux kernel's IP framewor…7
• CVE-2022-30283In UsbCoreDxe, tampering with the contents of the USB workin…7.5
• CVE-2022-30284In the python-libnmap package through 0.7.2 for Python, remo…9.8
• CVE-2022-30285In Quest KACE Systems Management Appliance (SMA) through 12.…9.8
• CVE-2022-30286pyscriptjs (aka PyScript Demonstrator) in PyScript through 2…7.5
• CVE-2022-30287Horde Groupware Webmail Edition through 5.2.22 allows a refl…8
• CVE-2022-30288Agoo before 2.14.3 does not reject GraphQL fragment spreads …7.5