Low Privileged Remote Attacker Can Abuse CSRF Tokens of Higher Privileged Users

CVE-2024-7698

Summary

A vulnerability exists within VDE products that allows remote attackers with low privileges to gain unauthorized access to Cross-Site Request Forgery (CSRF) tokens belonging to higher privileged users. This access can be exploited to orchestrate CSRF attacks, which may lead to unauthorized actions being performed on behalf of the privileged users. The affected products are at risk, highlighting the need for users to implement mitigative measures and stay informed on security updates.

References