CVE-2020-9388

2021-02-0300:00:00

mitre

www.cve.org

csrf protection

squaredup

version 4.6.0

admin

code execution

html dashboard

malicious svg payload

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

28.0%

JSON

CSRF protection was not present in SquaredUp before version 4.6.0. A CSRF attack could have been possible by an administrator executing arbitrary code in a HTML dashboard tile via a crafted HTML page, or by uploading a malicious SVG payload into a dashboard.