PT-2020-15978
CVE-2020-25142
·
تاريخ النشر
2020-09-25
·
تاريخ التحديث
2020-09-29
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Observium Professional, Enterprise & Community version 20.8.10631
Description
The issue allows attackers to forge malicious requests due to the lack of an unpredictable CSRF token in links and forms. This can be exploited to perform actions such as adding Device Settings via the "/addsrv" API endpoint.
Recommendations
For Observium Professional, Enterprise & Community version 20.8.10631, consider implementing an unpredictable CSRF token in all links and forms to prevent malicious requests. As a temporary workaround, restrict access to the "/addsrv" URI to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾