CVE-2025-42616
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-352
Falsificación de petición en sitios cruzados (Cross-Site Request Forgery)
Fecha de publicación:
08/12/2025
Última modificación:
08/12/2025
Descripción
*** Pendiente de traducción *** Some endpoints in vulnerability-lookup that modified <br />
application state (e.g. changing database entries, user data, <br />
configurations, or other privileged actions) may have been accessible <br />
via HTTP GET requests without requiring a CSRF token. This flaw leaves <br />
the application vulnerable to Cross-Site Request Forgery (CSRF) attacks:<br />
an attacker who tricks a logged-in user into visiting a malicious <br />
website could cause the user’s browser to issue GET requests that <br />
perform unintended state-changing operations in the context of their <br />
authenticated session.<br />
<br />
<br />
Because the server would treat these GET requests as valid (since no <br />
CSRF protection or POST method enforcement was in place), the attacker <br />
could exploit this to escalate privileges, change settings, or carry out<br />
other unauthorized actions without needing the user’s explicit consent <br />
or awareness. <br />
The fix ensures that all state-changing endpoints now require HTTP POST <br />
requests and include a valid CSRF token. This enforces that state <br />
changes cannot be triggered by arbitrary cross-site GET requests. This issue affects Vulnerability-Lookup: before 2.18.0.
Impacto
Puntuación base 4.0
7.00
Gravedad 4.0
ALTA