VULNERABILITY INTELLIGENCE

CVE-2019-12784

CVSS score8.8 HIGH

EPSS probability0.69%

CISA KEVNot currently listed

Published2020-07-14

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE-2019-12783, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site, allowing them to guess and potentially compromise valid credentials without ever sending any traffic from their own machine to the target site.

Weakness classification

CWE-352: Cross-Site Request Forgery (CSRF)

Primary references

cve@mitre.org — Third Party Advisory, VDB Entry
cve@mitre.org — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory