Cyber Resilience

CVE-2024-11071

CSRF

Published
07 April 2025
Modified
15 April 2026
CVSS Score v4 7.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0019 9th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2024-11071 is a high-severity CSRF (CWE-352) vulnerability in Co (inferred from references). Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery (CSRF) attack, which probabilistically enables JSON Hijacking (aka JavaScript Hijacking) via forgery…

more

web page.* Due to product customization, version information may differ from the following version description. For further inquiries, please contact the vendor.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
T1659 Content Injection Initial Access
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-28792Shared CWE-942
CVE-2026-46608Shared CWE-942
CVE-2026-54753Shared CWE-942
CVE-2025-13984Shared CWE-942
CVE-2026-50088Shared CWE-942
CVE-2026-24435Shared CWE-942
CVE-2026-5302Shared CWE-942
CVE-2026-30924Shared CWE-942
CVE-2026-15966Shared CWE-942
CVE-2024-10315Shared CWE-942

Affected Assets

Co
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V3.4.3
  • V3.4.6
  • V3.3.2
  • V3.5.1

Mitigating Controls (NIST 800-53 r5) AI

Information flow enforcement requires approved authorizations and would reject policies permitting untrusted domains.

Access enforcement requires verifying that state-changing requests originate from the authenticated user rather than a forged cross-site source.

Protecting session authenticity prevents attackers from replaying or forging authenticated requests via the victim's browser.

Boundary protection at external interfaces stops unauthorized cross-domain communication allowed by permissive policies.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 mostly match
prevents

Hardened configuration baselines and reviews directly prevent permissive CSP or cross-domain policies.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.

ID.RA-01 partial match
prevents

Vulnerability identification processes can surface permissive policy misconfigurations.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect overly permissive cross-domain policies but does not prevent their initial introduction.

degrades

Network security policies can restrict cross-domain communication but do not specifically mandate strict CSP or cross-domain policy configuration.

degrades

Security of network services includes defining allowed endpoints, which can limit untrusted domains but does not directly address web-client policy files.

mitigates

By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.

prevents

Application security requirements should specify secure CSP and cross-domain policy settings, directly addressing the weakness.

prevents

Secure architecture principles include defining trust boundaries, which can reduce permissive cross-domain allowances.

References