Lucene search
Veracode Vulnerability DatabaseVERACODE:37132HistorySep 19, 2022 - 8:48 a.m.
Cross-site Request Forgery (CSRF)
2022-09-1908:48:13
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
10
csrf
rdiffweb
vulnerability
get request
repository deletions
user deletions
attack
0.001 Low
EPSS
Percentile
30.1%
rdiffweb is vulnerable to cross-site request forgery. The vulnerability exists in repository and user deletions because the server accepts the GET request for deleting repositories and users which allows an attacker to cause a CSRF attack.
References
github.com/advisories/GHSA-cw2v-wv4g-w4p6
github.com/ikus060/rdiffweb/blob/ab2ad9a905efc7313fb0193373c21210275b6160/rdiffweb/controller/page_delete.py#L64-L81
github.com/ikus060/rdiffweb/commit/422791ea45713aaaa865bdca74addb9fffd93a71
huntr.dev/bounties/15c8fd98-7f50-4d46-b013-42710af1f99c
huntr.dev/bounties/15c8fd98-7f50-4d46-b013-42710af1f99c/
Related
huntr
huntr
prion
prion
Cross site request forgery (csrf)
2022-09-17 20:15:00
osv
osv
PYSEC-2022-281
2022-09-17 20:15:00
CVE-2022-3232
2022-09-17 20:15:09
cve
cve
CVE-2022-3232
2022-09-17 20:15:09
cvelist
cvelist
CVE-2022-3232 Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb
2022-09-17 19:40:08
nvd
nvd
CVE-2022-3232
2022-09-17 20:15:09
github
github