Searchblox · Searchblox · CVE-2018-11538
**Name of the Vulnerable Software and Affected Versions**
SearchBlox version 8.6.6
**Description**
The issue concerns a CSRF token bypass in the servlet/UserServlet endpoint. This allows for potential exploitation via the `u name`, `u passwd1`, `u passwd2`, `role`, and `X-XSRF-TOKEN` POST parameters.
**Recommendations**
For SearchBlox version 8.6.6, consider restricting access to the servlet/UserServlet endpoint until a patch is available. As a temporary workaround, disabling the use of the `u name`, `u passwd1`, `u passwd2`, `role`, and `X-XSRF-TOKEN` parameters in this endpoint may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.