Home
HIGH: 7.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:NHIGH: 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HDefault status
unaffected
5.24.10.* (custom) before 5.24.10.2303
affected
5.23.10.* (custom) before 5.23.12.2450
affected
5.23.02.* (custom) before 5.23.08.2451
affected
5.22.* (custom) before 5.22.12.2446
affected
5.21.*, 5.20.*, 5.19.* (custom) before 5.21.12.2303
affected
Description
Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery (CSRF) attack, which probabilistically enables JSON Hijacking (aka JavaScript Hijacking) via forgery web page.* Due to product customization, version information may differ from the following version description. For further inquiries, please contact the vendor.
Problem types
CWE-352 Cross-Site Request Forgery (CSRF)
CWE-942 Permissive Cross-domain Policy with Untrusted Domains
Product status
5.24.10.* (custom) before 5.24.10.2303
5.23.10.* (custom) before 5.23.12.2450
5.23.02.* (custom) before 5.23.08.2451
5.22.* (custom) before 5.22.12.2446
5.21.*, 5.20.*, 5.19.* (custom) before 5.21.12.2303
Credits
jskimpwn(김지섭, Jisub Kim)
arang(유재욱, Jaewook You)