Description
Darktrace Enterprise Immune System before 3.1 allows CSRF via the /config endpoint.
References (4)
Core 4
Core References
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_bugtraq
https://seclists.org/bugtraq/2019/May/54
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/152986/Darktrace-Enterpise-Immune-System-3.0.9-3.0.10-Cross-Site-Request-Forgery.html
Exploit, Technical Description, Third Party Advisory x_refsource_misc
https://www.peerlyst.com/posts/exploiting-two-zero-days-in-a-darktrace-appliance-cve-2019-9596-and-cve-2019-9597-gerwout-van-der-veen
Exploit, Third Party Advisory x_refsource_misc
https://github.com/gerwout/CVE-2019-9596-and-CVE-2019-9597/blob/master/poc.html
Scores
CVSS v3
6.5
EPSS
0.0098
EPSS Percentile
57.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Details
CWE
CWE-352
Status
published
Products (1)
darktrace/enterprise_immune_system
< 3.1
Published
Oct 23, 2019
Tracked Since
Feb 18, 2026