Cross Site Request Forgery in Aviatrix Controller Web Interface
CVE-2020-13416

6.5MEDIUM

Key Information:

Vendor

Aviatrix
Status
Controller
Vendor
CVE Published:
22 May 2020

What is CVE-2020-13416?

Aviatrix Controller prior to version 5.4.1066 contains a vulnerability that allows unauthorized API calls for password resets. The Controller Web Interface does not require a session token parameter, making it susceptible to Cross Site Request Forgery (CSRF) attacks. This flaw potentially enables malicious actors to initiate password resets on behalf of legitimate users, compromising account security.

References

https://docs.aviatrix.com/HowTos/security_bulletin_articl...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.