8.8

CVE-2021-41764

Exploit
A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local files. As a result, attackers could make a logged-in administrator upload arbitrary local files via a CSRF attack and send them to the attacker.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Streama Project ≫ Streama Version <= 1.10.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.68% 0.476
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

https://gist.github.com/omriinbar/3c741d309e5d0ede29dc7ecdad4eba3f
Third Party Advisory
Exploit
https://gist.github.com/omriinbar/8277193731d0edf20ef71299f304ab93
Third Party Advisory
https://github.com/streamaserver/streama
Third Party Advisory
Product