CVE-2018-11538

Name of the Vulnerable Software and Affected Versions SearchBlox version 8.6.6

Description The issue concerns a CSRF token bypass in the servlet/UserServlet endpoint. This allows for potential exploitation via the u name, u passwd1, u passwd2, role, and X-XSRF-TOKEN POST parameters.

Recommendations For SearchBlox version 8.6.6, consider restricting access to the servlet/UserServlet endpoint until a patch is available. As a temporary workaround, disabling the use of the u name, u passwd1, u passwd2, role, and X-XSRF-TOKEN parameters in this endpoint may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.