CVE-2023-46699

2023-12-2607:20:48

jpcert

www.cve.org

cve

cross-site request forgery

user settings

growi

security vulnerability

version 6.0.0

5.1 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user’s intention.

CNA Affected

[
  {
    "vendor": "WESEEK, Inc.",
    "product": "GROWI",
    "versions": [
      {
        "version": "prior to v6.0.0",
        "status": "affected"
      }
    ]
  }
]