ghsa-gmj8-84r4-h46j
Vulnerability from github
Published
2022-09-23 00:00
Modified
2022-09-23 20:38
Severity
Summary
rdiffweb Cross-Site Request Forgery vulnerability can lead to user email ID being changed
Details
rdiffwen prior to version 2.4.7 is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can change a user's email ID. Version 2.4.7 has a fix for this issue.
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "rdiffweb" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.4.7" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2022-3274" ], "database_specific": { "cwe_ids": [ "CWE-352" ], "github_reviewed": true, "github_reviewed_at": "2022-09-23T20:38:52Z", "nvd_published_at": "2022-09-22T19:15:00Z", "severity": "HIGH" }, "details": "rdiffwen prior to version 2.4.7 is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can change a user\u0027s email ID. Version 2.4.7 has a fix for this issue.", "id": "GHSA-gmj8-84r4-h46j", "modified": "2022-09-23T20:38:52Z", "published": "2022-09-23T00:00:31Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3274" }, { "type": "WEB", "url": "https://github.com/ikus060/rdiffweb/commit/e974df75bdbcff3996ad70bd1b4424ec1485ea3f" }, { "type": "PACKAGE", "url": "https://github.com/ikus060/rdiffweb" }, { "type": "WEB", "url": "https://huntr.dev/bounties/8834c356-4ddb-4be7-898b-d76f480e9c3f" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H", "type": "CVSS_V3" } ], "summary": "rdiffweb Cross-Site Request Forgery vulnerability can lead to user email ID being changed" }
Loading...