sn-cicd (>=4.6.12, <=4.6.17) potentially affected by CVE-2023-52555 via mongo-express (1.0.0-alpha.1)

mongo-express NPM version 1.0.0-alpha.1 is affected by a known vulnerability. The following packages have a transitive dependency on mongo-express and may be impacted: - sn-cicd =4.6.12, =4.6.17 Source cves: CVE-2023-52555 Source advisory: OSV:GHSA-FFFG-CWC9-XVJ7...

CVE-2023-52555

creationtimestamp| type| source ---|---|--- 2024-03-01 09:26:13+00:00| seen| https://t.me/ctinow/197410 2024-03-01 09:31:30+00:00| seen| https://t.me/ctinow/197420...

CVE-2023-52555

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...

CVE-2023-52555

CVE-2023-52555 : Mongo-Express 1.0.2 is vulnerable to Cross-Site Request Forgery via the /admin endpoint due to missing CSRF protection. An attacker could cause unauthorized actions (e.g., deletion of a Collection). Exploitation details are not provided in the available sources. References consis...