PT-2025-10975 · Opal · Opal

Parnuski · Publicado 2025-03-11 · Atualizado 2025-03-12 · CVE-2025-27792

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Opal versions prior to 5.1.1

Description: The issue concerns insufficient protections against cross-site request forgery (CSRF) in the Opal application. The application checks the referrer header and returns a 403 error if it is invalid. However, this protection can be bypassed by dropping the referrer header from CSRF requests using <meta name="referrer" content="never">.

Recommendations: For versions prior to 5.1.1, update to version 5.1.1 to resolve the issue.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

AZL-62429

CVE-2025-27792

GHSA-27VW-29RQ-C358

Produtos afetados

Opal

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27792.json · Exploit
• 🔥 https://github.com/obiba/opal/security/advisories/GHSA-27vw-29rq-c358 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27792 · Nota de Segurança
• https://osv.dev/vulnerability/AZL-62429 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1899713908287439327 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-27792 · Aviso do Fabricante