CVE-2021-41764

HIGH

streama <= 1.10.3 - Cross-Site Request Forgery via File Upload

Title source: llm
STIX 2.1

Description

A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local files. As a result, attackers could make a logged-in administrator upload arbitrary local files via a CSRF attack and send them to the attacker.

References (3)

Core 3
Core References
Product, Third Party Advisory x_refsource_misc
https://github.com/streamaserver/streama
Exploit, Third Party Advisory x_refsource_misc
https://gist.github.com/omriinbar/3c741d309e5d0ede29dc7ecdad4eba3f

Scores

CVSS v3 8.8
EPSS 0.0068
EPSS Percentile 48.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (1)
streama_project/streama < 1.10.3
Published Sep 29, 2021
Tracked Since Feb 18, 2026