PT-2023-25055 · Casdoor · Casdoor

Omriman067 · Publicado 2023-06-22 · Atualizado 2023-06-28 · CVE-2023-34927

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Casdoor versions 1.331.0 and below

Description The issue is related to a Cross-Site Request Forgery (CSRF) in the "/api/set-password" endpoint. This allows attackers to change a victim user's password by supplying a crafted URL.

Recommendations For Casdoor versions 1.331.0 and below, as a temporary workaround, consider restricting access to the "/api/set-password" endpoint until a patch is available. Avoid using this endpoint in scenarios where CSRF attacks are possible. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-34927

GHSA-RWCP-QRWG-56CG

Produtos afetados

Casdoor

Referências · 10

• 🔥 https://github.com/casdoor/casdoor/issues/1531 · Exploit
• 🔥 https://exploit-db.com/exploits/52439 · Exploit
• 🔥 https://exploit-db.com/exploits/52432 · Exploit
• 🔥 https://exploit-db.com/exploits/51961 · Exploit
• https://github.com/casdoor/casdoor · Nota
• https://osv.dev/vulnerability/GHSA-rwcp-qrwg-56cg · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-34927 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-34927 · Aviso do Fabricante
• https://casdoor.org · Nota
• https://gist.github.com/omriman067/4e90a3a4ffa40984f011d8777a995469 · Nota