CVE-2021-27759CWE-352

This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally

Low · published May 6, 2022

CVSS v3.1
2.3
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application.

The record
Technical detail
CVSS v3.1
2.3 · LOW
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C/CR:L/IR:L/AR:L/MAV:A/MAC:H/MPR:L/MUI:R/MS:U/MC:X/MI:N/MA:N
CVSS v4.0
Not supplied
EPSS
0.00300 · 21.6th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-05-06T18:10Z
EPSS history
Timeline
  • 06 MAY 18:10Z
    This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally
    cvelistv5