CVE-2020-27574: 
Rumpus vulnerability analysis and mitigation

Maxum Rumpus versions 8.2.13 and 8.2.14 are affected by a cross-site request forgery (CSRF) vulnerability (CVE-2020-27574). If an authenticated user visits a malicious page, unintended actions could be performed in the web application with the privileges of the authenticated user (NVD, MITRE).

The vulnerability exists in the web application's user management functionality. The application lacks proper CSRF protections, such as tokens and origin checks, in its forms handling. While the edit account form uses POST method, it does not implement CSRF tokens or origin verification, making it vulnerable to cross-origin requests (Security Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (NVD).

An attacker can exploit this vulnerability to perform unauthorized actions on behalf of authenticated users. When combined with other vulnerabilities (CVE-2020-27575 for command injection and CVE-2020-27576 for XSS), it can lead to complete system compromise with root access on the underlying system if the web user account management feature is enabled (Security Advisory).

The vulnerability is exploitable by tricking an authenticated user with administrative privileges to visit a malicious webpage. The page can contain specially crafted forms or images that automatically submit requests to create new user accounts or modify existing ones. Proof of concept exploits have been published demonstrating how this vulnerability can be chained with other vulnerabilities to achieve root access (Security Advisory).

No official patch is available for this vulnerability. The recommended mitigation is to disable the remote user management functionality in the application's network settings. This will prevent exploitation of the CSRF vulnerability in the user management features (Security Advisory).