CVE-2024-3782 is a high severity vulnerability (CVSS 8.8) in WBSAirback. A cross-site request forgery flaw lets an attacker craft an HTML form that performs privileged actions when a privileged user runs it. The record cites an INCIBE-CERT advisory on multiple vulnerabilities in WBSAirback.
What's affected
- White Bear Solutions WBSAirback version 21.02.04, according to the record.
Severity in the record: High, CVSS 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In plain terms: over the network, no privileges required, user interaction required. Weakness class: CWE-352, cross-site request forgery.
Fixed version: The record cites an INCIBE-CERT advisory on multiple vulnerabilities in WBSAirback. Check it for the fixed release.
The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source reviewed here reports exploitation in the wild.
How to check if you're exposed
- Inventory where WBSAirback is deployed, including test and forgotten servers.
- Search your servers and container images for the product name and compare the version against the affected list above.
- If you cannot confirm the version, treat the installation as exposed until the vendor says otherwise.
What to do now
- Install the vendor fix when it is published.
- Have administrators use a separate browser profile for the management console and sign out when finished.
- Do not browse other sites or open links from untrusted mail while signed in as an administrator.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3782.
Why it matters
Cross-site request forgery tricks a signed in user's browser into sending a request the user did not intend. The server sees valid session cookies and carries out the action. Applications defend against it with per request anti-forgery tokens, same-site cookie settings, and checks on the origin of state changing requests.
This attack needs a privileged user to open a page or form the attacker controls, so user behavior is part of the risk. The score is High because a successful request runs with the administrator's rights. Together with the command injection in CVE-2024-3781, from the same advisory, plan one upgrade that covers both.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Quick check
How does a user trigger it?
The record says the privileged user has to execute a manipulated HTML form. Browsing untrusted pages while signed in as an administrator is the risk.
Is CVE-2024-3782 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
