CVE-2016-10529 No CSRF Validation in droppy
HighCVSS 8.8
EPSS 0.48%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm droppy(npm) | < 3.5.0 | 3.5.0 |
| droppy project droppy | < 3.5.0 | 3.5.0 |
| HackerOne droppy node module | = <3.5.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com
- www.npmjs.com
- nodesecurity.io third-party-advisory