Cross Site Request Forgery in Aviatrix Controller Web Interface
CVE-2020-13416
6.5MEDIUM
Summary
Aviatrix Controller prior to version 5.4.1066 contains a vulnerability that allows unauthorized API calls for password resets. The Controller Web Interface does not require a session token parameter, making it susceptible to Cross Site Request Forgery (CSRF) attacks. This flaw potentially enables malicious actors to initiate password resets on behalf of legitimate users, compromising account security.
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved