sn-cicd (>=4.6.12, <=4.6.17) potentially affected by CVE-2023-52555 via mongo-express (1.0.0-alpha.1)

mongo-express NPM version 1.0.0-alpha.1 is affected by a known vulnerability. The following packages have a transitive dependency on mongo-express and may be impacted: - sn-cicd =4.6.12, =4.6.17 Source cves: CVE-2023-52555 Source advisory: OSV:GHSA-FFFG-CWC9-XVJ7...

CVE-2023-52555

creationtimestamp| type| source ---|---|--- 2024-03-01 09:26:13+00:00| seen| https://t.me/ctinow/197410 2024-03-01 09:31:30+00:00| seen| https://t.me/ctinow/197420...

CVE-2023-52555

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...

CVE-2023-52555

The mongo-express web-based management interface, specifically version 1.0.2 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The flaw exists in the /admin endpoint, where an attacker could potentially perform unauthorized actions, such as the deletion of a Collection . To mitigate ...