Uploaded image for project: 'Bitbucket Data Center'
  1. Bitbucket Data Center
  2. BSERV-5336

TemporaryAvatarController.save is vulnerable to CSRF/XSRF

    XMLWordPrintable

Details

    Description

      As pointed out in STASH-5335, the
      TemporaryAvatarController.save resource is vulnerable to CSRF. Currently there appears to be no impact of it being vulnerable except for making a user upload a temporary avatar file (which are periodically deleted).

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. BSERV-5335 User avatar upload endpoint is vulnerable to XSRF

          • Low - Low priority issues
          • Closed
          Is related to

          SCT-1985 Loading...

          mentioned in

          Page Loading...

          Page Loading...

          Activity

            People

              mszczepanski Marcin
              dblack David Black
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: