DivvyDrive Information Technologies Inc. disclosed a Cross‑Site Request Forgery (CSRF) vulnerability that allows malicious actors to convince authenticated users to submit unintended requests, potentially altering data or initiating actions without the user’s consent. This flaw corresponds to CWE‑352 and can lead to accidental or malicious changes in system state, compromising data integrity and trust.

The vulnerability affects DivvyDrive Information Technologies Inc.’s DivvyDrive versions starting at 4.8.2.9 and lasting until before 4.8.3.2. Systems running any 4.8.2.x or earlier 4.8.3.x builds are exposed.

The CVSS score of 6.5 reflects a moderate risk. The EPSS score of <1% indicates a very low likelihood of exploitation, yet the lack of a KEV listing does not reduce the urgency of remediation. Attackers can likely exploit the flaw by embedding crafted requests in emails or external websites, which will be sent by a victim’s authenticated browser. This represents an inferred CSRF attack vector that forces the victim’s browser to send state‑changing requests without consent. Successful exploitation enables attackers to perform privileged operations on behalf of the user.