Lucene search
GoogleOSV:GHSA-X95C-QRQR-2V27HistoryMar 16, 2022 - 12:00 a.m.
CSRF vulnerability and missing permission checks in Extended Choice Parameter Plugin allow SSRF
2022-03-1600:00:43
Google
osv.dev
8
csrf
vulnerability
missing permission
extended choice parameter plugin
ssrf
form validation
permission check
EPSS
0.001
Percentile
22.0%
Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not perform a permission check on form validation methods. This allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Related
cve
cve
CVE-2022-27205
2022-03-15 17:15:11
nvd
nvd
CVE-2022-27205
2022-03-15 17:15:11
alpinelinux
alpinelinux
CVE-2022-27205
2022-03-15 17:15:11
prion
prion
Information disclosure
2022-03-15 17:15:00
cnvd
cnvd
github
github
cvelist
cvelist
CVE-2022-27205
2022-03-15 16:45:52
