Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite the request.host value with the content of the X-Forwarded-Host HTTP header.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
xunfeng anti-csrf decorator 跨站请求伪造漏洞
Vulnerability Description
xunfeng（巡风）是一套适用于企业内网的漏洞快速应急和资产扫描系统。anti-csrf decorator是其中的一个CSRF处理组件。 xunfeng 0.2.0版本中的anti-csrf decorator存在跨站请求伪造漏洞，该漏洞源于views/lib/AntiCSRF.py文件可以借助X-Forwarded-Host HTTP包头值覆盖request.host值。远程攻击者可借助Flash文件利用该漏洞修改配置。
CVSS Information
N/A
Vulnerability Type
N/A