Flexense Sync Breeze Enterprise Server and Disk Pulse Enterprise Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in Flexense Sync Breeze Enterprise Server and Disk Pulse Enterprise, both version 10.4.18. This vulnerability allows an authenticated user to trick another user into performing unintended actions within the application. The issue arises from inadequate implementation of CSRF tokens. Exploitation could involve sending a POST request to rename commands, using the '/rename_command?sid=' endpoint and targeting the 'command_name' parameter.

Impact

Exploitation of this vulnerability could lead to unauthorized actions being performed on behalf of the user, potentially allowing for manipulation of application data or settings.