CVE-2020-13416

Name of the Vulnerable Software and Affected Versions Aviatrix Controller versions prior to 5.4.1066

Description The issue allows for a Cross Site Request Forgery (CSRF) vulnerability, specifically for password resets, due to a Controller Web Interface session token parameter not being required on an API call.

Recommendations For versions prior to 5.4.1066, update to version 5.4.1066 or later to resolve the issue. As a temporary workaround, consider restricting access to the API endpoint related to password resets until the update is applied.