PT-2023-26586 · Wger · Wger Workout Manager
0X72303074
·
Published
2023-08-08
·
Updated
2023-08-11
·
CVE-2023-38759
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
wger Project wger Workout Manager version 2.2.0a3
Description
A Cross Site Request Forgery (CSRF) issue allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/reset user password.html, templates/user/overview.html, core/views/user.py, and templates/user/preferences.html, core/forms.py components. This can be exploited through the
user-management feature.Recommendations
As a temporary workaround, consider disabling the
user-management feature until a patch is available. Restrict access to the vulnerable components, such as gym/views/gym.py, templates/gym/reset user password.html, templates/user/overview.html, core/views/user.py, and templates/user/preferences.html, core/forms.py, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wger Workout Manager