同じ製品で同じ時期に公表された 8 件の脆弱性の 1 つです。まとめた解説: Apache Juneauに脆弱性、9.2.1で修正版が公開
Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a ...
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 修正版 |
|---|---|---|---|
| Apache Software Foundation | Apache Juneau |
9.2.1 未満 |
9.2.1 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau.
The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an endpoint without a CORS preflight, defeating protections that rely on the HTTP method or content type instead of an anti-CSRF token.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue. Applications that do not use the content parameter can also set disableContentParam to true.
出典: oss-security (Openwall) NVD GitHub Advisory