PT-2020-15978 · Observium · Observium

Maciej Domański · Published 2020-09-25 · Updated 2020-09-29 · CVE-2020-25142

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Observium Professional, Enterprise & Community version 20.8.10631

Description The issue allows attackers to forge malicious requests due to the lack of an unpredictable CSRF token in links and forms. This can be exploited to perform actions such as adding Device Settings via the "/addsrv" API endpoint.

Recommendations For Observium Professional, Enterprise & Community version 20.8.10631, consider implementing an unpredictable CSRF token in all links and forms to prevent malicious requests. As a temporary workaround, restrict access to the "/addsrv" URI to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-25142

Affected Products

Observium

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-25142 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25142 · Vendor Advisory
• https://gist.github.com/ahpaleus/76aa81ec82644a89c2088ab3ea99f07c · Note