Cross-site Request Forgery (CSRF)

2018-04-1005:24:41

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

43.6%

JSON

kotti is vulnerable to cross-site request forgery (CSRF) attacks. The vulnerability exists when assigning local roles where a change in permission can occur in the /admin-document/@@share view request.

CPENameOperatorVersion
kottile2.0.0b1
kottile1.3.1

CPE	Name	Operator	Version
	kotti	le	2.0.0b1
	kotti	le	1.3.1

References

github.com/Kotti/Kotti/commit/00b56681fa9fb8587869a5e00dcd56503081d3b9

github.com/Kotti/Kotti/commit/69d3c8a5d7203ddaec5ced5901acf87baddd76be

github.com/Kotti/Kotti/issues/551

0.001 Low

EPSS

Percentile

43.6%

JSON

Related for VERACODE:6070