Cross site request forgery (csrf)

2023-01-0108:15:00

PRIOn knowledge base

www.prio-n.com

cross site request forgery

csrf

perfsonar

version 4.4.6

participant discovery

http request header

local address

nvd

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.6%

perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address.

CPENameOperatorVersion
perfsonarlt4.4.6

CPE	Name	Operator	Version
	perfsonar	lt	4.4.6

References

www.perfsonar.net/releasenotes-2022-11-09-4-4-6.html

zxsecurity.co.nz/research/advisories/perfsonar-multiple/