GitHub Advisoryadvisory · PyPI

GHSA-74j6-3hh4-w3f5 rdiffweb Cross-Site Request Forgery vulnerability

MEDIUM Published 2022-09-23 Modified 2024-10-25 Official page ↗
Aliases
CVE-2022-3267
Ecosystem
PyPI
Packages
rdiffweb
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-352
Reviewed
2022-09-23

Affected packages

• PyPI rdiffweb: < 2.4.6 → fixed in 2.4.6

Description

rdiffweb prior to 2.4.6 is vulnerable to cross-site request forgery on the repository settings. A malicious user can change the settings of a repository by sending a URL to the victim. This issue is fixed in version 2.4.6.

Related

Alias · CVE (1)

  • CVE-2022-3267 Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References