CVE-2021-47722

Zucchetti Axess CLOKI Access Control 1.64 contains a cross-site request forgery vulnerability that allows attackers to manipulate access control settings without user interaction. Attackers can craft malicious web pages with hidden forms to disable or modify access control parameters by tricking authenticated users into loading the page.

CVSS v4.0

5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

3.5 LOWCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

EPSS

0.20% chance of exploitation in the next 30 days, 10th percentile

Published

2025-12-23

Updated

2026-04-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/50595

References

• CVE Record
• NVD entry

Related

• CVE-2021-47721
• CVE-2021-47723
• CVE-2021-47720
• CVE-2021-47724
• CVE-2021-47719
• CVE-2021-47725