Cloud Solutions SAS Wimi Teamwork up to 7.38.16 csrf_token cross-site request forgery

Summaryinfo

A vulnerability has been found in Cloud Solutions SAS Wimi Teamwork up to 7.38.16 and classified as problematic. This affects an unknown function. This manipulation of the argument csrf_token causes cross-site request forgery. This vulnerability is handled as CVE-2025-34133. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Cloud Solutions SAS Wimi Teamwork up to 7.38.16 and classified as critical. Affected by this vulnerability is an unknown part. The manipulation of the argument csrf_token with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery (CSRF) vulnerability in its API. The API accepts any authenticated request that contains a JSON field named 'csrf_token' without validating the field’s value; only the presence of the field is checked. An attacker can craft a cross-site request that causes a logged-in victim’s browser to submit a JSON POST containing an arbitrary or empty 'csrf_token', and the API will execute the request with the victim’s privileges. Successful exploitation can allow an attacker to perform privileged actions as the victim potentially resulting in account takeover, privilege escalation, or service disruption.

The weakness was released by Noa Tchoumak. It is possible to read the advisory at wimi-teamwork.com. This vulnerability is known as CVE-2025-34133 since 04/15/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 7.38.17 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-36201). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Cloud Solutions SAS

Name

• Wimi Teamwork

Version

• 7.38.0
• 7.38.1
• 7.38.2
• 7.38.3
• 7.38.4
• 7.38.5
• 7.38.6
• 7.38.7
• 7.38.8
• 7.38.9
• 7.38.10
• 7.38.11
• 7.38.12
• 7.38.13
• 7.38.14
• 7.38.15
• 7.38.16

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion