Lucene search

Veracode Vulnerability DatabaseVERACODE:45081

HistoryJan 18, 2024 - 10:45 a.m.

Cross-Site Request Forgery (CSRF)

2024-01-1810:45:51

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

pyload

csrf

vulnerability

session cookie

api call

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

29.5%

JSON

pyLoad is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability is due to a missing SameSite attribute for the session cookie. This allows an attacker to perform a Cross-Site Request Forgery (CSRF) attack via an API call.

References

github.com/pyload/pyload/commit/1374c824271cb7e927740664d06d2e577624ca3e

github.com/pyload/pyload/commit/c7cdc18ad9134a75222974b39e8b427c4af845fc

github.com/pyload/pyload/security/advisories/GHSA-pgpj-v85q-h5fm

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

29.5%

JSON

Related for VERACODE:45081