PT-2020-13528 · Aviatrix · Aviatrix Controller

Published 2020-05-22 · Updated 2020-05-26 · CVE-2020-13416

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Aviatrix Controller versions prior to 5.4.1066

Description The issue allows for a Cross Site Request Forgery (CSRF) vulnerability, specifically for password resets, due to a Controller Web Interface session token parameter not being required on an API call.

Recommendations For versions prior to 5.4.1066, update to version 5.4.1066 or later to resolve the issue. As a temporary workaround, consider restricting access to the API endpoint related to password resets until the update is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-13416

Affected Products

Aviatrix Controller

References · 4

• https://osv.dev/vulnerability/CVE-2020-13416 · Vendor Advisory
• https://docs.aviatrix.com/HowTos/security_bulletin_article.html#csrf-on-password-reset · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13416 · Security Note
• https://t.me/cvenotify/4029 · Telegram Post