GitHub Advisoryadvisory · Packagist

GHSA-4j8w-p6hv-3qxc Cross-Site Request Forgery (CSRF) in automad/automad

MEDIUM Published 2023-12-21 Modified 2024-08-19 Official page ↗
Aliases
CVE-2023-7038
Ecosystem
Packagist
Packages
automad/automad
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-352
Reviewed
2023-12-29

Affected packages

• Packagist automad/automad: < 2.0.0-alpha.1 → fixed in 2.0.0-alpha.1

Description

automad up to 1.10.9 does not implement anti-CSRF tokens by default, making it vulnerable Cross-Site Request Forgery (CSRF). An attacker may exploit this vulnerability to force an admin into creating or deleting users. An exploit has been disclosed publicly.

Related

Alias · CVE (1)

  • CVE-2023-7038 A vulnerability was found in automad up to 1.10.9. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References