6.8
CVE-2025-53897
- EPSS 0.2%
- Veröffentlicht 29.11.2025 02:24:36
- Zuletzt bearbeitet 03.12.2025 17:48:27
- CVE-Watchlists
- Unerledigt
LoginKiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerability
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to log information from the system by tricking an administrator into browsing a specifically crafted fake page of Kiteworks MFT. This issue has been patched in version 9.1.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Accellion ≫ Kiteworks Managed File Transfer Version < 9.1.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.2% | 0.098 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 6.8 | 1.6 | 5.2 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-cxwc-7899-3h4m