CVE-2026-61502: rejetto hfs, CSRF

Описание

Оригинално описание

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine.

Засегнати продукти

• rejetto hfs: 3.0.0 преди 3.2.1

Вид слабост

• CWE-352 CSRF

История

Други уязвимости в rejetto hfs

• 6.9CVE-2026-61505
• 5.4CVE-2026-61504
• 6.9CVE-2026-61503
• 6.1CVE-2026-61501
• 9.8CVE-2026-61500

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-61502
• https://nvd.nist.gov/vuln/detail/CVE-2026-61502
• https://github.com/rejetto/hfs/releases/tag/v3.2.1
• https://www.vulncheck.com/advisories/rejetto-hfs-cross-site-request-forgery-via-get-requests