Cross site request forgery (csrf)

2020-05-2221:15:00

PRIOn knowledge base

www.prio-n.com

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.6%

JSON

An issue was discovered in Aviatrix Controller before 5.4.1066. A Controller Web Interface session token parameter is not required on an API call, which opens the application up to a Cross Site Request Forgery (CSRF) vulnerability for password resets.

CPENameOperatorVersion
controllerlt5.4.1066

CPE	Name	Operator	Version
	controller	lt	5.4.1066

References

docs.aviatrix.com/HowTos/security_bulletin_article.html