GitHub Advisoryadvisory · PyPI

GHSA-gmj8-84r4-h46j rdiffweb Cross-Site Request Forgery vulnerability can lead to user email ID being changed

HIGH Published 2022-09-23 Modified 2024-10-25 Official page ↗
Aliases
CVE-2022-3274
Ecosystem
PyPI
Packages
rdiffweb
Severity
High
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H
Weaknesses
CWE-352
Reviewed
2022-09-23

Affected packages

• PyPI rdiffweb: < 2.4.7 → fixed in 2.4.7

Description

rdiffwen prior to version 2.4.7 is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can change a user's email ID. Version 2.4.7 has a fix for this issue.

Related

Alias · CVE (1)

  • CVE-2022-3274 Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References