CVE-2021-26474

UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS

CVE	CVE-2021-26474
Title	UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS
Case	DIVD-2020-00011
Credits	Discovered by Wietse Boonstra () Addional research by Frank Breedijk ()
CVSS
References	https://csirt.divd.nl/cases/DIVD-2020-00011/ ( x_refsource_CONFIRM ) https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ ( x_refsource_CONFIRM ) https://www.wbsec.nl/vembu ( x_refsource_CONFIRM ) https://csirt.divd.nl/cves/CVE-2021-26474/ ( x_refsource_CONFIRM )
Problem type(s)	n/a
Date published	07 Jul 2021 00:00 CEST
Last modified	04 Feb 2022 22:33 CET

Description

Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)

JSON version.

DIVD CSIRT

CVE-2021-26474

UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS

Description