PT-2020-13528
CVE-2020-13416
·
تاريخ النشر
2020-05-22
·
تاريخ التحديث
2020-05-26
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Aviatrix Controller versions prior to 5.4.1066
Description
The issue allows for a Cross Site Request Forgery (CSRF) vulnerability, specifically for password resets, due to a Controller Web Interface session token parameter not being required on an API call.
Recommendations
For versions prior to 5.4.1066, update to version 5.4.1066 or later to resolve the issue. As a temporary workaround, consider restricting access to the API endpoint related to password resets until the update is applied.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾