MEDIUM
CSRF in wallabag/wallabag
Published Nov 15, 2024
6.5
MEDIUMCVSS 3.1
EPSS 0.31%
Description
wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4.
Affected products
-
- Version unspecifiedStatusaffectedConstraints<2.5.4
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Wallabag | Wallabag/wallabag | n/a |
|
-
- Version 0StatusaffectedConstraints<2.5.4
- Version
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (5)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3229 Advisory
- https://github.com/advisories/GHSA-99w8-c5f6-96pp Advisory
- https://github.com/wallabag/wallabag/commit/268372dbbdd7ef87b84617fdebf95d0a86caf7dc Patch
- https://huntr.com/bounties/4ba20fe7-4061-4dfb-ab2f-ecaf110641a5 Exploit
- https://nvd.nist.gov/vuln/detail/CVE-2023-0737
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner @huntr_ai
Published Nov 15, 2024
Updated Nov 20, 2024
Reserved Feb 7, 2023
Link CVE-2023-0737
CISA Vulnrichment
Updated Nov 20, 2024
ENISA EUVD
EUVD-2024-3229 GHSA-99W8-C5F6-96PP Assigner @huntr_ai
Published Nov 15, 2024
Updated Nov 20, 2024
Exploited since n/a
Link EUVD-2024-3229