CVE-2020-27574
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A CSRF vulnerability in Maxum Rumpus 8.2.13 and 8.2.14 allows an attacker to perform unintended actions in the web application if an authenticated user visits a malicious page.
Risk Assessment
The risk is that an attacker can hijack the authenticated user's session and perform unauthorized operations, such as configuration changes or data theft.
Recommendation
It is recommended to immediately update to the latest version of Maxum Rumpus and implement CSRF protection mechanisms, such as anti-CSRF tokens.
Other vulnerabilities in Maxum Rumpus
See all- CVE-2020-27576Medium
A stored cross-site scripting (XSS) vulnerability in Maxum Rumpus 8.2.13 and 8.2.14 allows attackers to inject malicious scripts via folder names. Insufficient input validation leads to persistent script storage on the server.
- CVE-2020-27575High
Maxum Rumpus 8.2.13 and 8.2.14 are affected by a command injection vulnerability. The user management functionality in the web administration panel contains a parameter that, due to insufficient validation, allows execution of arbitrary system commands.
Original NVD description (English source)
Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF). If an authenticated user visits a malicious page, unintended actions could be performed in the web application as the authenticated user.