CVE-2020-25095 Cross-site request forgery in n/a
A CSRF vulnerability in LogRhythm Platform Manager allows attackers to hijack WebSockets and execute commands as a logged-in user.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-25095?
CVE-2020-25095 is a high-severity vulnerability in n/a, published on 17 Dec 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
LogRhythm Platform Manager (PM) 7.4.9 allows CSRF. The Web interface is vulnerable to Cross-site WebSocket Hijacking (CSWH). If a logged-in PM user visits a malicious site in the same browser session, that site can perform a CSRF attack to create a WebSocket from the victim client to the vulnerable PM server. Once the socket is created, the malicious site can interact with the vulnerable web server in the context of the logged-in user. This can include WebSocket payloads that result in command execution.
Weakness: CWE-352
Which versions are affected by CVE-2020-25095?
It affects 1 product.
Products include Logrhythm Platform Manager.
How do I fix CVE-2020-25095?
No fix has been published for CVE-2020-25095 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-25095 being exploited?
There is no known exploitation of CVE-2020-25095 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6mh7-r2rw-gp32.