Aleksandr Novikov Metrika versions up to 1.2 contain a CSRF vulnerability (CVE-2024-54420) that permits unauthorized commands to be transmitted from a user that the web application trusts. The vulnerability is exploitable remotely without privileges and requires user interaction. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation of this CSRF vulnerability could allow an attacker to perform unauthorized actions on behalf of an authenticated user, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens or other application-level mitigations if possible.