py-rate (>=0.1.2, <=0.2.0) potentially affected by CVE-2018-1000843 via luigi (1.3.0)

luigi PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - py-rate =0.1.2, =0.2.0 Source cves: CVE-2018-1000843 Source advisory: OSV:PYSEC-2018-11...

CVE-2018-1000843

CVE-2018-1000843 affects Luigi prior to 2.8.0. The root issue is a CSRF vulnerability in the API endpoint /api/ that can cause leakage of Task metadata (name, id, parameters, etc.) to unauthorized users. Exploitation requires the victim to visit a specially crafted webpage from a network where th...