CVE-2020-25562

In SapphireIMS 5.0, there is no CSRF token present in the entire application. This can lead to CSRF vulnerabilities in critical application forms like account resent.

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.50% chance of exploitation in the next 30 days, 42nd percentile

Published

2021-08-11

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://vuln.shellcoder.party/2020/09/19/cve-2020-25562-sapphireims-csrf/

Security advisories

• https://vuln.shellcoder.party/2020/09/19/cve-2020-25562-sapphireims-csrf
• https://vuln.shellcoder.party/tags/sapphireims

References

• CVE Record
• NVD entry