CVE-2025-27792: Opal vulnerable to CSRF protection bypass
Description
Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, the protections against cross-site request forgery (CSRF) were insufficient application-wide. The referrer header is checked, and if it is invalid, the server returns 403. However, the referrer header can be dropped from CSRF requests using ``, effectively bypassing this protection. Version 5.1.1 contains a patch for the issue.
Classification
CVE ID: CVE-2025-27792
CVSS Base Severity: HIGH
CVSS Base Score: 7.7
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Problem Types
CWE-352: Cross-Site Request Forgery (CSRF)Affected Products
Vendor: obiba
Product: opal
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.02% (probability of being exploited)
EPSS Percentile: 3.62% (scored less or equal to compared to others)
EPSS Date: 2025-04-09 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-27792https://github.com/obiba/opal/security/advisories/GHSA-27vw-29rq-c358