LogoDark mode logo
LogoDark mode logo
Contact SupportLoading Light/Dark Toggle

  • Licensing Overview
  • System Requirements, Server Spec and Sizing
    • Best Practices for Security
    • Signing and security for product files
    • Signing and security for sensitive tiles
    • CVE-2020-9388 - API Endpoints are not protected against CSRF
    • CVE-2020-9389 - Username enumeration possible via a timing attack
    • CVE-2020-9390 - Stored cross-site scripting (Web Content and Visio tile)
    • CVE-2021-40091 - SSRF issue
    • CVE-2021-40092 - Stored cross-site scripting (Image tile)
    • CVE-2021-40093 - Stored cross-site scripting (Action Buttons)
    • CVE-2021-40094 - DOM-based stored cross-site scripting
    • CVE-2021-40095 - Reading arbitrary files
    • CVE-2021-40096 - Stored cross-site scripting (provider configuration)
    • Information regarding CVE-2021-44228 - Apache Log4j 2
    • CVE-2022-46784 - Client side open redirection
    • CVE-2022-46785 - Prototype pollution leading to XSS
    • CVE-2022-46786 - Stored Cross-Site Scripting
    • CVE-2024-45180 - Stored cross-site scripting (Knowledge Editor tile)
  • EAM-X
  • Training
  • Support for older versions of SquaredUp DS
  • Understanding the figures on Performance graphs
  • SquaredUp DS and the SDK user limit
  • Useful PowerShell Commands
  • Square Up (the credit card company) payments and problems
referencesecurity advisorycve 2020 9388 api endpoints are not protected against csrf

CVE-2020-9388 - API Endpoints are not protected against CSRF

CVE: CVE-2020-9388

Description

Cross-Site Request Forgery (CSRF) is an attack that enables a malicious actor to execute unwanted actions. Before SquaredUp DS version 4.6, CSRF protection was not present for API endpoints.

This could be exploited by sending a SquaredUp DS user a link to a malicious site or implementing a forged request in a SquaredUp DS dashboard. When the malicious page is opened by the user, the request would be made to the SquaredUp DS API using the victim's session. For example, the malicious HTML code could make a successful request to add or remove users from the Named User list or upload a malicious SVG image (see CVE-2020-9390 - Stored cross-site scripting (Web Content and Visio tile)).

Fix

Since SquaredUp DS version 4.6, this vulnerability has been fixed. All requests are now validated using an appropriate token.

What should you do?

If you are using a SquaredUp DS version earlier than 4.6, update to version 4.6 or later.

Affected and resolved software versions

Product
Affected versions
Resolved versions
SquaredUp DS for SCOM
Versions earlier than 4.6
4.6 and later versions
SquaredUp DS for Azure
Versions earlier than 4.6
4.6 and later versions

Acknowledgement

SquaredUp would like to thank Giuseppe-Diego Gianni from NATO for reporting this vulnerability.

Did you notice a vulnerability or need further help?

Please contact SquaredUp Support

If you believe you've found a different security vulnerability in one of our products please report it by emailing our support team so we can work on fixing it: [email protected]

Revision history of this article

3.2.2021
Initial release
10.6.2021
Updated support contact information

Was this article helpful?


Have more questions or facing an issue?
Submit a ticket

On this page

  • Description
  • Affected and resolved software versions
  • Acknowledgement
  • Did you notice a vulnerability or need further help?
  • Revision history of this article

Footer

Sites

  • SQUAREDUP
  • SQUAREDUP DS
  • DOWNLOAD
  • COMMUNITY ANSWERS

Quick Links

  • SUBMIT A REQUEST
  • EVENTS
  • CAREERS

Small Print

  • PRIVACY POLICY
  • TERMS AND CONDITIONS
Youtubex (Twitter)LinkedIn

© SquaredUp 2025