CVE-2020-35722

Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in the Web Compliance Manager component of Quest Policy Authority for Unified Communications version 8.1.2.200 [1]. The endpoint submitUser.jsp does not enforce anti-CSRF tokens, allowing an attacker to force an authenticated administrator to unknowingly perform user creation or modification requests.

Exploitation

An attacker crafts a malicious link or form that, when clicked by a logged-in administrator with a valid session, sends a forged POST request to submitUser.jsp. No authentication is required for the attacker, but the victim must have an active session in the application. The attacker can predefine parameters to create a new user or alter existing user attributes.

Impact

Successful exploitation allows an attacker to create new user accounts or modify existing ones, potentially gaining unauthorized privileged access to the application. This could lead to full compromise of the Policy Authority system.

Mitigation

Quest has confirmed that Policy Authority for Unified Communications has reached end-of-life and is no longer supported. No patches are available [1]. Organizations should migrate to a supported alternative or isolate the application to prevent exposure.