CVE-2020-28191 : The console in Togglz before 2.9.4 allows CSRF.

The console in Togglz before 2.9.4 allows CSRF.

Published 2022-12-26 22:15:10

Updated 2023-01-05 23:00:17

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross-site request forgery (CSRF)

Products affected by CVE-2020-28191

Togglz » Togglz
Versions before (<) 2.9.4
cpe:2.3:a:togglz:togglz:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 50 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Assigned by: nvd@nist.gov (Primary)

https://github.com/advisories/GHSA-697v-pxg3-j262

Togglz console missing cross-site request forgery (CSRF) protection · CVE-2020-28191 · GitHub Advisory Database · GitHub
Third Party Advisory
https://github.com/togglz/togglz/pull/495

Added CSRF protection to the togglz console by JoeBeeton · Pull Request #495 · togglz/togglz · GitHub
Patch;Third Party Advisory
https://github.com/togglz/togglz/commit/ed66e3f584de954297ebaf98ea4a235286784707

Added CSRF protection to the togglz console via a CSRF token passed b… · togglz/togglz@ed66e3f · GitHub
Patch;Third Party Advisory

Jump to