CVE-2020-11818

CVE-2020-11818 affects Rukovoditel 2.5.2. The vulnerability arises from a CSRF protection mechanism using a form_session_token that can be bypassed with another user’s valid token, allowing an attacker to change the Admin password and escalate privileges. Documents consistently describe this CSRF...