What’s Vulnerable › Vulnerabilities

CVE-2020-9388

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-02-03 · updated 2026-06-17
• Weakness: CWE-352

Description

CSRF protection was not present in SquaredUp before version 4.6.0. A CSRF attack could have been possible by an administrator executing arbitrary code in a HTML dashboard tile via a crafted HTML page, or by uploading a malicious SVG payload into a dashboard.

Affected products

• Squaredup: before 4.6; through 4.6 — fixed in 4.6

How to fix

Upgrade to a fixed version: Squaredup 4.6. Check the vendor advisory for mitigations.

References

• https://scomsupport.squaredup.com/hc/en-us/articles/8862921957533-CVE-2020-9388-API-Endpoints-are-not-protected-against-CSRF
• https://support.squaredup.com/hc/en-us/articles/360017568238
• https://support.squaredup.com/hc/en-us/articles/360019427218-CVE-2020-9388-API-Endpoints-are-not-protected-against-CSRF
• https://scomsupport.squaredup.com/hc/en-us/articles/8862921957533-CVE-2020-9388-API-Endpoints-are-not-protected-against-CSRF
• https://support.squaredup.com/hc/en-us/articles/360017568238
• https://support.squaredup.com/hc/en-us/articles/360019427218-CVE-2020-9388-API-Endpoints-are-not-protected-against-CSRF

Get alerted when CVE-2020-9388 or the next vulnerability affects your stack