Mist Community Edition middleware.py session_start_response cross-site request forgery

CVE Details

Basic Information

Title Mist Community Edition middleware.py session_start_response cross-site request forgery
Type cve
Published 2025-06-01T22:31:05.433Z
Last Seen

Product Information

Vendor Mist
Product Community Edition
Version 4.7.0

CVSS Information

Base Score 5.3 (MEDIUM)
Attack Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Confidentiality Impact
Integrity Impact
Availability Impact

AI Analysis

AI Description The Mist Community Edition up to version 4.7.1 is vulnerable to a cross-site request forgery (CSRF) attack due to a flaw in the `session_start_response` function in `src/mist/api/auth/middleware.py`. This vulnerability allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue is addressed in version 4.7.2.
AI Severity Medium
Vendor Mist
Product Mist Community Edition
Affected Version <=4.7.1

Additional Information

CVE List
CWE List CWE-352, CWE-862
Bulletin Family
Source Data Mist Community Edition 4.7.0
Mist Community Edition 4.7.1

Source Information

Source Data Mist Community Edition 4.7.0
Mist Community Edition 4.7.1
Source Link

Description

A vulnerability was found in Mist Community Edition up to 4.7.1. It has been declared as problematic. This vulnerability affects the function session_start_response of the file src/mist/api/auth/middleware.py. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.7.2 is able to address this issue. The patch is identified as db10ecb62ac832c1ed4924556d167efb9bc07fad. It is recommended to upgrade the affected component.

CVSS Score Summary

Base Score: 5.3 (MEDIUM)

View Full CVE Details

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.