PT-2021-12848 · Squaredup · Squaredup

Giuseppe-Diego Gianni · Published 2021-02-03 · Updated 2023-02-23 · CVE-2020-9388

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SquaredUp versions prior to 4.6.0

Description: The issue allows for a potential CSRF attack, where an administrator could execute arbitrary code in a HTML dashboard tile via a crafted HTML page, or by uploading a malicious SVG payload into a dashboard. This is possible due to the lack of CSRF protection in SquaredUp before version 4.6.0.

Recommendations: For versions prior to 4.6.0, update to version 4.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to HTML dashboard tiles and disabling the upload of SVG payloads into dashboards until a patch is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-9388

Affected Products

Squaredup

References · 7

• https://support.squaredup.com/hc/en-us/articles/360017568238 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9388 · Vendor Advisory
• https://support.squaredup.com/hc/en-us/articles/360019427218-CVE-2020-9388-API-Endpoints-are-not-protected-against-CSRF · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9388 · Security Note
• https://t.me/cibsecurity/23036 · Telegram Post
• https://t.me/cvenotify/14576 · Telegram Post
• https://scomsupport.squaredup.com/hc/en-us/articles/8862921957533-CVE-2020-9388-API-Endpoints-are-not-protected-against-CSRF · Note