CVE-2020-25095

Katalog CVE

CVSS 8.8 · High EPSS 1,0%

Kerentanan Cross-Site Request Forgery (CSRF) pada logrhythm platform manager. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

LogRhythm Platform Manager (PM) 7.4.9 allows CSRF. The Web interface is vulnerable to Cross-site WebSocket Hijacking (CSWH). If a logged-in PM user visits a malicious site in the same browser session, that site can perform a CSRF attack to create a WebSocket from the victim client to the vulnerable PM server. Once the socket is created, the malicious site can interact with the vulnerable web server in the context of the logged-in user. This can include WebSocket payloads that result in command execution.

Rincian

Terbit di NVD

17 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 61,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days/ advisory pihak ketiga