PT-2023-27304 · Unknown · Social Media Skeleton

Zodiac0704 · Publicado 2023-08-18 · Atualizado 2023-08-23 · CVE-2023-40172

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Social media skeleton versions prior to 1.0.5

Description A Cross-site request forgery (CSRF) attack is a type of malicious attack whereby an attacker tricks a victim into performing an action on a website that they do not intend to do. This can be done by sending the victim a malicious link or by exploiting a vulnerability in the website. The Social media skeleton project did not properly restrict CSRF attacks prior to version 1.0.5.

Recommendations For versions prior to 1.0.5, upgrade to version 1.0.5 to address the CSRF vulnerability. As a temporary workaround, consider implementing additional security measures to restrict malicious requests, but it is advised to upgrade as soon as possible since there are no known workarounds for this vulnerability.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-40172

GHSA-873H-PQJX-3PWG

Produtos afetados

Social Media Skeleton

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40172.json · Exploit
• https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-873h-pqjx-3pwg · Nota
• https://github.com/fobybus/social-media-skeleton/commit/344d798e82d6cc39844962c6d3cb2560f5907848 · Correção
• https://t.me/cvenotify/56898 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-40172 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1692661096866337060 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-40172 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1692699885877776653 · Publicação no Twitter
• https://t.me/cibsecurity/68851 · Publicação no Telegram