Lucene search

GoogleOSV:CVE-2023-27295

HistoryFeb 28, 2023 - 5:15 p.m.

CVE-2023-27295

2023-02-2817:15:11

Google

osv.dev

opencats

csrf

vulnerability

attackers

unauthorized actions

javascript

authenticated user

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

32.4%

JSON

Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy page that executes Javascript in an authenticated user’s session when visited.

CPENameOperatorVersion
opencatseqdelete
opencatseq0.9.6
opencatseq0.9.3-1
opencatseq0.9.3
opencatseq0.9.3-2
opencatseq0.9.3-3-test-release
opencatseq0.9.3-2-test-release
opencatseq0.9.3-3
opencatseq0.9.1a
opencatseqopencats-0.9.3

Name	Operator	Version
opencats	eq	delete
opencats	eq	0.9.6
opencats	eq	0.9.3-1
opencats	eq	0.9.3
opencats	eq	0.9.3-2
opencats	eq	0.9.3-3-test-release
opencats	eq	0.9.3-2-test-release
opencats	eq	0.9.3-3
opencats	eq	0.9.1a
opencats	eq	opencats-0.9.3

Rows per page:

1-10 of 161

References

www.tenable.com/security/research/tra-2023-8

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

32.4%

JSON

Related for OSV:CVE-2023-27295