CVE-2025-59893
Last modified
CVE-2025-59893 is a high-severity vulnerability rated 8/10 on the CVSS scale. Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to rename commands via '/rename_command?sid=', affecting the 'command_name' parameter.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Flexense | Diskpulse | 10.4.18 |
| Flexense | Syncbreeze | 10.4.18 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-59893?
How severe is CVE-2025-59893?
How do I fix CVE-2025-59893?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-59887Improper authentication of library files in the Eaton UPS Co…8.6
- CVE-2025-59888Improper quotation in search paths in the Eaton UPS Companio…6.7
- CVE-2025-59889Improper authentication of library files in the Eaton IPP so…8.6
- CVE-2025-59890Improper input sanitization in the file archives upload func…7.3
- CVE-2025-59891Cross-Site request forgery (CSRF) vulnerability in Sync Bree…8
- CVE-2025-59892Cross-Site request forgery (CSRF) vulnerability in Sync Bree…8
- CVE-2025-59894Cross-Site request forgery (CSRF) vulnerability in Sync Bree…8
- CVE-2025-59895Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterp…7.5
- CVE-2025-59896Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterp…5.4
- CVE-2025-59897Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterp…5.4
- CVE-2025-59898Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterp…5.4
- CVE-2025-59899Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterp…5.4
Are you affected by CVE-2025-59893?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST