EUVD-2026-28359
GHSA-r92j-v37g-pjf9
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
5DescriptionNVD
Cross-Site request forgery (CSRF) vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross Site Request Forgery.
This issue affects DivvyDrive: from 4.8.2.9 before 4.8.3.2.
AnalysisAI
Cross-Site Request Forgery in DivvyDrive 4.8.2.9 through 4.8.3.1 allows remote attackers to execute unauthorized actions with high integrity and confidentiality impact when authenticated users interact with malicious content. The CVSS 9.6 (Critical) score reflects scope change and full CIA triad compromise, though EPSS data and KEV status are unavailable. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: inventory all DivvyDrive deployments and identify instances running versions 4.8.2.9-4.8.3.1; restrict access to affected systems to internal networks only and disable external sharing features if available. Within 7 days: contact DivvyDrive vendor for patch timeline and interim mitigations; implement mandatory reauthentication for sensitive operations and deploy SameSite cookie protections if configurable. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today