Vulnerability Description
A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local files. As a result, attackers could make a logged-in administrator upload arbitrary local files via a CSRF attack and send them to the attacker.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Streama Project | Streama | <= 1.10.3 |
Related Weaknesses (CWE)
References
- https://gist.github.com/omriinbar/3c741d309e5d0ede29dc7ecdad4eba3fExploitThird Party Advisory
- https://gist.github.com/omriinbar/8277193731d0edf20ef71299f304ab93Third Party Advisory
- https://github.com/streamaserver/streamaProductThird Party Advisory
- https://gist.github.com/omriinbar/3c741d309e5d0ede29dc7ecdad4eba3fExploitThird Party Advisory
- https://gist.github.com/omriinbar/8277193731d0edf20ef71299f304ab93Third Party Advisory
- https://github.com/streamaserver/streamaProductThird Party Advisory
FAQ
What is CVE-2021-41764?
CVE-2021-41764 is a vulnerability with a CVSS score of 8.8 (HIGH). A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local file...
How severe is CVE-2021-41764?
CVE-2021-41764 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-41764?
Check the references section above for vendor advisories and patch information. Affected products include: Streama Project Streama.