CVE-2026-73099 Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override
Description
Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an endpoint without a CORS preflight, defeating protections that rely on the HTTP method or content type instead of an anti-CSRF token. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. Applications that do not use the content parameter can also set disableContentParam to true.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- Interaction
- None
- Confidentiality
- High
- Integrity
- High
- Availability
- High
- Confidentiality of other systems
- High
- Integrity of other systems
- High
- Availability of other systems
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Juneau 9.2 | earliest → < 9.2.1 | 9.2.1 |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified