漏洞标题
N/A
漏洞描述信息
在Datalust Seq 2024.3.13545之前的版本中发现了一个问题。当使用Entra ID或OpenID Connect身份验证时，如果用户访问了受损或恶意的网站，或者在使用用户名/密码或Active Directory身份验证时，用户访问了与Seq服务器具有相同有效顶级域名的受损或恶意网站，由于缺少Content-Type验证，可能会导致CSRF（跨站请求伪造）漏洞。利用该漏洞，攻击者可以进行冒充攻击，并代表目标用户在Seq中执行操作。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
漏洞类别
跨站请求伪造(CSRF)
漏洞标题
N/A
漏洞描述信息
An issue was discovered in Datalust Seq before 2024.3.13545. Missing Content-Type validation can lead to CSRF when (1) Entra ID or OpenID Connect authentication is in use and a user visits a compromised/malicious site, or (2) when username/password or Active Directory authentication is in use and a user visits a compromised/malicious site under the same effective top-level domain as the Seq server. Exploitation of the vulnerability allows the attacker to conduct impersonation attacks and perform actions in Seq on behalf of the targeted user.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
漏洞类别
跨站请求伪造(CSRF)