GitHub Advisoryadvisory · Packagist

GHSA-w9pg-7c3h-fc8j ipl/web's `ipl\Web\Common\CsrfCounterMeasure` is susceptible to CSRF

LOW Published 2024-08-05 Modified 2024-08-06 Official page ↗
Aliases
CVE-2024-41811
Ecosystem
Packagist
Packages
ipl/web
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-352
Reviewed
2024-08-05

Affected packages

• Packagist ipl/web: < 0.10.1 → fixed in 0.10.1

Description

Impact Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF) Affected products: • Icinga Web (>=2.12.0) • Icinga DB Web (>=1.0.0) • Icinga Notifications Web (>=0.1.0) • Icinga Web JIRA Integration (>=1.3.0) All affected products, in any version, will be unaffected by this once `icinga-php-library` is upgraded. Patches Version 0.10.1 will include a fix for this. It will be published as part of the `icinga-php-library` v0.14.1 release.

Related

Alias · CVE (1)

  • CVE-2024-41811 ipl/web is a set of common web components for php projects. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References