An issue was discovered in Aviatrix Controller before 5.4.1066. A Controller Web Interface session token parameter is not required on an API call, which opens the application up to a Cross Site Request Forgery (CSRF) vulnerability for password resets.
Vector
NETWORK
Complexity
MEDIUM
Authentication
NONE
Confidentiality
NONE
Integrity
PARTIAL
Availability
NONE
| Advisory | Patch | Confirmed | Link |
|---|---|---|---|
| https://docs.aviatrix.com/HowTos/security_bulletin_artic... |