PT-2025-10722 · Datalust · Datalust Seq
Published
2025-03-11
·
Updated
2025-10-10
·
CVE-2025-27912
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Datalust Seq versions prior to 2024.3.13545
Description
A problem was discovered in Datalust Seq where missing Content-Type validation can lead to CSRF attacks. This occurs when a user visits a compromised or malicious site, either under the same effective top-level domain as the Seq server when using username/password or Active Directory authentication, or when using Entra ID or OpenID Connect authentication. The exploitation of this issue allows an attacker to conduct impersonation attacks and perform actions in Seq on behalf of the targeted user.
Recommendations
For versions prior to 2024.3.13545, update to version 2024.3.13545 or later to resolve the issue. As a temporary workaround, consider restricting access to the Seq server to minimize the risk of exploitation, especially when users are accessing potentially compromised or malicious sites under the same effective top-level domain.
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Datalust Seq