CVE-2025-42616
Severity CVSS v4.0:
HIGH
Type:
CWE-352
Cross-Site Request Forgery (CSRF)
Publication date:
08/12/2025
Last modified:
08/12/2025
Description
Some endpoints in vulnerability-lookup that modified <br />
application state (e.g. changing database entries, user data, <br />
configurations, or other privileged actions) may have been accessible <br />
via HTTP GET requests without requiring a CSRF token. This flaw leaves <br />
the application vulnerable to Cross-Site Request Forgery (CSRF) attacks:<br />
an attacker who tricks a logged-in user into visiting a malicious <br />
website could cause the user’s browser to issue GET requests that <br />
perform unintended state-changing operations in the context of their <br />
authenticated session.<br />
<br />
<br />
Because the server would treat these GET requests as valid (since no <br />
CSRF protection or POST method enforcement was in place), the attacker <br />
could exploit this to escalate privileges, change settings, or carry out<br />
other unauthorized actions without needing the user’s explicit consent <br />
or awareness. <br />
The fix ensures that all state-changing endpoints now require HTTP POST <br />
requests and include a valid CSRF token. This enforces that state <br />
changes cannot be triggered by arbitrary cross-site GET requests. This issue affects Vulnerability-Lookup: before 2.18.0.
Impact
Base Score 4.0
7.00
Severity 4.0
HIGH