CVE-2021-20786
Medium
Description
Cross-site request forgery (CSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0) allows a remote attacker to hijack the authentication of administrators via a specially crafted URL.
SeverityMedium
CVSS4.3
Exploit probability—
ProductGroupsession
PublishedJul 30, 2021
First seenJul 30, 2021
How to fix
Update
- groupsession groupsession5.1.0 or later
- groupsession groupsession_bycloud5.1.0 or later
- groupsession groupsession_zion5.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| groupsession groupsession | 2.20 ≤ v < 5.1.0 | 5.1.0 |
| groupsession groupsession_bycloud | 3.0.3 ≤ v < 5.1.0 | 5.1.0 |
| groupsession groupsession_zion | 3.0.3 ≤ v < 5.1.0 | 5.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.