CVE-2025-13394

Name of the Vulnerable Software and Affected Versions Carbon console (affected versions not specified)

Description The Ajax processor fails to protect state-changing operations from Cross-Site Request Forgery (CSRF), a type of attack that tricks an authenticated user into executing unintended actions. The issue arises because the processor uses the HTTP GET method for these operations. Although the SameSite=Lax cookie attribute is used, it is bypassed because it allows cookies to be sent with cross-origin top-level navigation requests. An attacker can exploit this to perform unauthorized state-altering requests, potentially leading to data modification, account changes, or loss of user control. This is only feasible if the console and related services are exposed to the public internet.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.