ENG-10078 - CSRF in account security settings bug

- tags :: Jira 15Five Security

Description

See attached PDF of vulnerability.

Affects MFA (Account and user administration)

Fix needs to be on staging by 6/20/2020 to be ready for remediation testing.

May 27 discussion: Investigate whether CSRF is enabled on the MFA endpoint. Spike to commence ASAP.