6.8Mittel
CVE-2025-53897Kiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerability
Beschreibung
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to log information from the system by tricking an administrator into browsing a specifically crafted fake page of Kiteworks MFT. This issue has been patched in version 9.1.0.
Schwachstellentyp (CWE):
CWE-352
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| accellion | kiteworks managed file transfer | < 9.1.0 | |
| kiteworks | security-advisories | < 9.1.0 |
Referenzen und Patches
- https://github.com/kiteworks/security-advisories/security/advisories/GHSA-cxwc-7899-3h4m PatchThird Party Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:accellion:kiteworks_managed_file_transfer:*:*:*:*:*:*:*:*< 9.1.0