Lara: XSRF (Cross-Site Request Forgery) Vulnerability

Users of Lara please be advised of a XSRF (Cross-Site Request Forgery) vulnerability that has been identified.

To view this vulnerability, possible remedies, and others please check out the Security Advisories at Critical Watch (http://criticalwatch.com/support/security-advisories.aspx)

Amplify’d from www.criticalwatch.com

HTB22619: [HTB22619] XSRF (CSRF) in Lara

Product: Lara

Vulnerability Type: CSRF (Cross-Site Request Forgery)

Vulnerability Details: The vulnerability exists due to failure in the /_ui/changepassword script to properly verify the source of HTTP request. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data. Read more at www.criticalwatch.com

 

See this Amp at http://bit.ly/cWzn4M