PT-2025-10975 · Opal · Opal

Parnuski · Published 2025-03-11 · Updated 2025-03-12 · CVE-2025-27792

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Opal versions prior to 5.1.1

Description: The issue concerns insufficient protections against cross-site request forgery (CSRF) in the Opal application. The application checks the referrer header and returns a 403 error if it is invalid. However, this protection can be bypassed by dropping the referrer header from CSRF requests using <meta name="referrer" content="never">.

Recommendations: For versions prior to 5.1.1, update to version 5.1.1 to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

AZL-62429

CVE-2025-27792

GHSA-27VW-29RQ-C358

Affected Products

Opal

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27792.json · Exploit
• 🔥 https://github.com/obiba/opal/security/advisories/GHSA-27vw-29rq-c358 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27792 · Security Note
• https://osv.dev/vulnerability/AZL-62429 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27792 · Vendor Advisory
• https://twitter.com/CVEnew/status/1899713908287439327 · Twitter Post