CVE-2025-5410

MEDIUM EPSS 15.2%

Published Jun 1, 20251y ago · Modified Jun 17, 20261w ago

5.3 CVSS 4.0

Medium

Published Jun 1, 2025 1y ago

Last Modified Jun 17, 2026 1w ago

Description

A vulnerability was found in Mist Community Edition up to 4.7.1. It has been declared as problematic. This vulnerability affects the function session_start_response of the file src/mist/api/auth/middleware.py. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.7.2 is able to address this issue. The patch is identified as db10ecb62ac832c1ed4924556d167efb9bc07fad. It is recommended to upgrade the affected component.

CVSS Details

Base Score

5.3

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction P

Scope X

Threat Intelligence

EPSS Exploit Probability

15.2% percentile

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 2

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

CWE-862 Missing Authorization Authorization

Affected Products 1

Vendor	Product	Version	Range
mist	mist	*	<4.7.2

References 6

github.com https://github.com/Stolichnayer/mist-ce-csrf

ExploitThird Party Advisory
github.com https://github.com/mistio/mist-ce/releases/tag/v4.7.2

Release Notes
github.com https://github.com/mistio/mist.api/commit/db10ecb62ac832c1ed4924556d167efb9bc07fad

Patch
vuldb.com https://vuldb.com/?ctiid.310750

Permissions RequiredVDB Entry
vuldb.com https://vuldb.com/?id.310750

Third Party AdvisoryVDB Entry
vuldb.com https://vuldb.com/?submit.583532

Third Party AdvisoryVDB Entry

Remediation

github.com https://github.com/mistio/mist.api/commit/db10ecb62ac832c1ed4924556d167efb9bc07fad

Patch