Security readout for executives and security teams
Plain-English summary
Precurio Intranet Portal 2.0 is reported vulnerable to cross-site request forgery that can result in creation of administrative accounts. For an intranet portal, unauthorized administrator access could expose internal content and user data. Public exploit information exists, but the provided sources do not show active exploitation.
Executive priority
Prioritize verification if Precurio 2.0 is still deployed. The main business risk is unauthorized administrative access to an intranet platform. Treat as a near-term remediation item, especially for externally reachable or broadly accessible instances.
Technical view
The advisory describes missing CSRF protection around administrative user creation in Precurio Intranet Portal 2.0. The CVSS v4 vector is network-accessible, low complexity, no privileges, with user interaction present. The record lists CWE-434, which appears inconsistent with the CSRF description, so validate against the primary CVE and advisory.
Likely exposure
Organizations running Precurio Intranet Portal 2.0 are the known exposed population. Risk is higher where the portal is reachable by untrusted users or where administrators use it from browsers that may encounter attacker-controlled content.
Exploitation context
Exploit-DB is listed as a public exploit reference, and VulnCheck has an advisory. The CVE is not in CISA KEV in the provided data, and no provided source states active exploitation. CSRF typically depends on inducing a target browser action.
Researcher notes
Evidence supports a public advisory and exploit reference, but not active exploitation. The CVSS vector includes user interaction, while the description says unauthenticated request forgery; model exposure conservatively. The listed CWE does not align cleanly with CSRF and should not drive remediation decisions alone.
Mitigation direction
- Check Precurio vendor guidance for a supported update or configuration mitigation.
- Restrict portal access to trusted networks or VPN users where feasible.
- Review and remove unexpected administrative accounts immediately.
- Enforce least privilege for portal administrators.
- If maintaining custom code, add CSRF protections to administrative actions.
Validation and detection
- Inventory Precurio Intranet Portal deployments and confirm whether version 2.0 is present.
- Review user records for newly created or unexpected administrator accounts.
- Inspect application logs for unusual administrative user creation activity.
- Confirm whether administrative forms enforce anti-CSRF protections.
- Document compensating controls limiting who can reach the portal.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2018-25168 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-45860CVE reference · exploit
- VulnCheck Advisory: Precurio Intranet Portal 2.0 Cross-Site Request Forgery Add AdminCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.