PT-2023-27304 · Unknown · Social Media Skeleton

Zodiac0704 · Published 2023-08-18 · Updated 2023-08-23 · CVE-2023-40172

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Social media skeleton versions prior to 1.0.5

Description A Cross-site request forgery (CSRF) attack is a type of malicious attack whereby an attacker tricks a victim into performing an action on a website that they do not intend to do. This can be done by sending the victim a malicious link or by exploiting a vulnerability in the website. The Social media skeleton project did not properly restrict CSRF attacks prior to version 1.0.5.

Recommendations For versions prior to 1.0.5, upgrade to version 1.0.5 to address the CSRF vulnerability. As a temporary workaround, consider implementing additional security measures to restrict malicious requests, but it is advised to upgrade as soon as possible since there are no known workarounds for this vulnerability.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-40172

GHSA-873H-PQJX-3PWG

Affected Products

Social Media Skeleton

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40172.json · Exploit
• https://github.com/fobybus/social-media-skeleton/commit/344d798e82d6cc39844962c6d3cb2560f5907848 · Patch
• https://osv.dev/vulnerability/CVE-2023-40172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40172 · Security Note
• https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-873h-pqjx-3pwg · Note
• https://t.me/cvenotify/56898 · Telegram Post
• https://twitter.com/CVEnew/status/1692661096866337060 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1692699885877776653 · Twitter Post
• https://t.me/cibsecurity/68851 · Telegram Post