AZL-62429
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-62429.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-62429
- Upstream
- Published
- 2025-03-11T22:15:13Z
- Modified
- 2026-04-21T04:32:02.394961Z
- Summary
- CVE-2025-27792 affecting package opal 3.10.11-13
- Details
-
Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, the protections against cross-site request forgery (CSRF) were insufficient application-wide. The referrer header is checked, and if it is invalid, the server returns 403. However, the referrer header can be dropped from CSRF requests using
<meta name="referrer" content="never">, effectively bypassing this protection. Version 5.1.1 contains a patch for the issue. - References