What is the CVSS score of CVE-2025-70031?

CVE-2025-70031 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sunbirded Portal are affected by CVE-2025-70031?

A Cross-Site Request Forgery (CSRF) vulnerability in Sunbird-Ed portal v1.13.4 allows attackers to perform unauthorized actions on behalf of authenticated users without their knowledge or consent.

How to fix or mitigate CVE-2025-70031?

Within 24 hours: Identify all Sunbird-Ed portal instances in your environment and document current user populations; assess whether the portal handles sensitive transactions or administrative functions. Within 7 days: Implement compensating controls including WAF rules to validate CSRF tokens, enable SameSite cookie attributes, and restrict cross-origin requests; communicate risk to business owners. Within 30 days: Plan and execute upgrade to patched version when available; monitor vendor advisory channels weekly for patch release; conduct security awareness training on CSRF risks for end users.

Sunbirded Portal CVE-2025-70031

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-09 cve@mitre.org

CSRF Sunbirded Portal

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Mar 09, 2026 - 20:16 nvd

HIGH 8.8

DescriptionCVE.org

An issue pertaining to CWE-352: Cross-Site Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.

AnalysisAI

An issue pertaining to CWE-352: Cross-Site Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. [CVSS 8.8 HIGH]

Technical ContextAI

Classified as CWE-352 (Cross-Site Request Forgery (CSRF)). An issue pertaining to CWE-352: Cross-Site Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.