Threats tagged 'ghsa-w28c-j5m7-w8fm'

A Cross-Site Request Forgery (CSRF) vulnerability affects multiple WSO2 products due to the use of HTTP GET requests for state-changing operations in admin services, particularly in the Carbon console's event processor. The SameSite=Lax cookie attribute is insufficient to prevent exploitation because it allows cookies to be sent with cross-origin top-level navigations using GET requests. An attacker can exploit this by tricking an authenticated user into visiting a malicious link, causing unauthorized administrative actions. WSO2 recommends not exposing Carbon console services to untrusted networks to reduce risk.