Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Vulnerability in CSRF test

carlos_gabriel_millaqueo_picunche
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
September 9, 2020

Hi,

It has been identified that the forms do not have mechanisms to
prevent CSRF attacks, because of this, a malicious user can force the browser to
a victim user to generate and send requests that the application interprets as legitimate
from the victim. A successful CSRF attack can compromise the data of a
end user and through this enter "valid" requests that modify the
behavior of the application in favor of the attacker

We have a lastest versión of crowd 4.1.0 dockerized with mysql database

Thank you.

Regards

1 answer

0 votes
Nic Brough -Adaptavist-
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
September 9, 2020

Right.  So have you reported this?  Is it possibly fixed in a later version?

carlos_gabriel_millaqueo_picunche
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
September 11, 2020

It has not been fixed in the latest version, we have reported it

Donn Gordon
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
December 4, 2020

yes, and also in the RelayState parameter, they are lacking the business logic of the anti-CSRF. 

Suggest an answer

Log in or Sign up to answer
TAGS
AUG Leaders

Atlassian Community Events