CVE-2020-13259 Cross-site request forgery in n/a
Unauthenticated remote attackers can perform arbitrary actions via CSRF by tricking users into clicking malicious links on the RAD SecFlow-1v web interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-13259?
CVE-2020-13259 is a high-severity vulnerability in n/a, published on 16 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF_0290_2.3.01.26 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. This could be exploited in conjunction with CVE-2020-13260.
Weakness: CWE-352
Which versions are affected by CVE-2020-13259?
It affects 1 product.
Products include Rad Secflow-1v Firmware.
How do I fix CVE-2020-13259?
No fix has been published for CVE-2020-13259 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-13259 being exploited?
There is no known exploitation of CVE-2020-13259 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-88vv-mqm2-ch6r.