bem-register (>=1.0.0 <=1.0.5), itstep_server (=0.0.1) +5 more potentially affected by CVE-2023-52555 via mongo-express (>=0.19.0 <=1.0.0-alpha.1)

mongo-express NPM version =0.19.0, =1.0.0, =0.1.1, =1.0.0, =4.6.12, =1.5.0, =1.6.1 Source cves: CVE-2023-52555 Source advisory: OSV:GHSA-FFFG-CWC9-XVJ7...

CVE-2023-52555

creationtimestamp| type| source ---|---|--- 2024-03-01 09:26:13+00:00| seen| https://t.me/ctinow/197410 2024-03-01 09:31:30+00:00| seen| https://t.me/ctinow/197420...

CVE-2023-52555

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...

CVE-2023-52555

CVE-2023-52555 : Mongo-Express 1.0.2 is vulnerable to Cross-Site Request Forgery via the /admin endpoint due to missing CSRF protection. An attacker could cause unauthorized actions (e.g., deletion of a Collection). Exploitation details are not provided in the available sources. References consis...