Lucene search

MitreCVE-2023-43149

HistoryOct 12, 2023 - 6:15 p.m.

CVE-2023-43149

2023-10-1218:15:10

CWE-352

mitre

web.nvd.nist.gov

cve-2023-43149

spa-cart

cross site request forgery

csrf

vulnerability

admin user addition

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

39.3%

JSON

SPA-Cart 1.9.0.3 is vulnerable to Cross Site Request Forgery (CSRF) that allows a remote attacker to add an admin user with role status.

Affected configurations

Nvd

Node

spa-cartspa-cartMatch1.9.0.3

VendorProductVersionCPE
spa-cartspa-cart1.9.0.3cpe:2.3:a:spa-cart:spa-cart:1.9.0.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
spa-cart	spa-cart	1.9.0.3	cpe:2.3:a:spa-cart:spa-cart:1.9.0.3:::::::*

References

github.com/MinoTauro2020/CVE-2023-43149

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

39.3%

JSON

Related for CVE-2023-43149