CVE-2026-73099criticalCWE-352

CVE-2026-73099: falha crítica em Apache Juneau

Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override

Publicada em

Seguir esta CVE+ Monitorar Apache Juneau

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 10epss 0.2%
Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an endpoint without a CORS preflight, defeating protections that rely on the HTTP method or content type instead of an anti-CSRF token. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. Applications that do not use the content parameter can also set disableContentParam to true.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
Apache Software Foundation · Apache Juneau
CVEs relacionadas — Apache Juneau

No mesmo produto, das mais perigosas para as menos.

CVE-2026-121489CRITICALApache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directoryEPSS 0.5%CVE-2026-73098CRITICALApache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsingEPSS 0.5%CVE-2026-96677CRITICALApache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chromeEPSS 0.4%CVE-2026-73117CRITICALApache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request dataEPSS 0.4%CVE-2026-73101CRITICALApache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaultsEPSS 0.4%CVE-2026-73100CRITICALApache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errorsEPSS 0.4%