Early Access — Mondoo Vulnerability Intelligence is currently in preview.
Arunna 1.0.0 contains a cross-site request forgery vulnerability that allows attackers to manipulate user profile settings without authentication. Attackers can craft a malicious form to change user details, including passwords, email, and administrative privileges by tricking authenticated users into submitting the form.
Exploitability
AV:NAC:LAT:NPR:NUI:NVulnerable System
VC:NVI:LVA:NSubsequent System
SC:LSI:LSA:L6.9/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:LAuthentication