PT-2026-103832
CVE-2026-94220
·
تاريخ النشر
2026-10-01
·
تاريخ التحديث
2026-10-09
الوصف من
CVSS 4.0
2.1
منخفضةالمقاييسAV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Name of the Vulnerable Software and Affected Versions
Apache APISIX versions 3.17.0 through 3.18.0
Description
Cross-Site Request Forgery (CSRF) exists in the feishu-auth and dingtalk-auth plugins. An attacker can trick a user into clicking a crafted link, causing the user's browser session on a protected route to be established under the attacker's identity. Consequently, any actions performed by the user during that session, such as form submissions, uploads, or account bindings, will be associated with the attacker's account.
Recommendations
Upgrade to version 3.19.0.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾