SquaredUp up to 4.5.x Dashboard cross-site request forgery

entryeditHistoryDiffjsonxmlCTI

A vulnerability was found in SquaredUp up to 4.5.x. It has been classified as problematic. This affects an unknown part of the component Dashboard. Upgrading to version 4.6.0 eliminates this vulnerability.

Field02/04/2021 10:51 AM02/23/2021 01:37 PM
nameSquaredUpSquaredUp
version<=4.5.x<=4.5.x
componentDashboardDashboard
cwe352 (cross site request forgery)352 (cross site request forgery)
risk11
cvss3_vuldb_avNN
cvss3_vuldb_acLL
cvss3_vuldb_uiRR
cvss3_vuldb_cNN
cvss3_vuldb_iLL
cvss3_vuldb_aNN
cvss3_vuldb_rlOO
cvss3_vuldb_rcCC
urlhttps://support.squaredup.com/hc/en-us/articles/360017568238https://support.squaredup.com/hc/en-us/articles/360017568238
nameUpgradeUpgrade
upgrade_version4.6.04.6.0
cveCVE-2020-9388CVE-2020-9388
date1612393200 (02/04/2021)1612393200 (02/04/2021)
cvss2_vuldb_avNN
cvss2_vuldb_acLL
cvss2_vuldb_ciNN
cvss2_vuldb_iiPP
cvss2_vuldb_aiNN
cvss2_vuldb_rcCC
cvss2_vuldb_rlOFOF
cvss2_vuldb_auSS
cvss2_vuldb_eNDND
cvss3_vuldb_prLL
cvss3_vuldb_sUU
cvss3_vuldb_eXX
cvss2_vuldb_basescore4.04.0
cvss2_vuldb_tempscore4.03.5
cvss3_vuldb_basescore3.53.5
cvss3_vuldb_tempscore3.53.4
cvss3_meta_basescore3.53.5
cvss3_meta_tempscore3.53.4
price_0day$0-$5k$0-$5k
cve_assigned1582585200
cve_nvd_summaryCSRF protection was not present in SquaredUp before version 4.6.0. A CSRF attack could have been possible by an administrator executing arbitrary code in a HTML dashboard tile via a crafted HTML page, or by uploading a malicious SVG payload into a dashboard.
confirm_urlhttps://support.squaredup.com/hc/en-us/articles/360017568238

Interested in the pricing of exploits?

See the underground prices here!