CVE-2021-29995

Опубликовано: 09 июн. 2021

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

A Cross Site Request Forgery (CSRF) issue in Server Console in CloverDX through 5.9.0 allows remote attackers to execute any action as the logged-in user (including script execution). The issue is resolved in CloverDX 5.10, CloverDX 5.9.1, CloverDX 5.8.2, and CloverDX 5.7.1.

Ссылки

http://packetstormsecurity.com/files/163697/CloverDX-5.9.0-Code-Execution-Cross-Site-Request-Forgery.html
Exploit
Third Party Advisory
VDB Entry
https://support.cloverdx.com/releases/
Release Notes
Vendor Advisory
https://support1.cloverdx.com/hc/en-us/articles/360021006520
Vendor Advisory
http://packetstormsecurity.com/files/163697/CloverDX-5.9.0-Code-Execution-Cross-Site-Request-Forgery.html
Exploit
Third Party Advisory
VDB Entry
https://support.cloverdx.com/releases/
Release Notes
Vendor Advisory
https://support1.cloverdx.com/hc/en-us/articles/360021006520
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cloverdx:cloverdx:*:*:*:*:*:*:*:*

Версия до 5.7.1 (исключая)

cpe:2.3:a:cloverdx:cloverdx:*:*:*:*:*:*:*:*

Версия от 5.8.0 (включая) до 5.8.2 (исключая)

cpe:2.3:a:cloverdx:cloverdx:*:*:*:*:*:*:*:*

Версия от 5.9.0 (включая) до 5.9.1 (исключая)

EPSS

Процентиль: 82%

0.01725

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-2w86-3xc7-pmwq

CVSS3: 8.8

github

больше 3 лет назад

EPSS

Процентиль: 82%

0.01725

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352