Cross-Site Request Forgery (CSRF)

2023-08-2204:11:26

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

wallabag

csrf

developercontroller.php

vulnerability

api key

get request

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

26.5%

JSON

wallabag/wallabag is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability exists in the deleteClientAction function of DeveloperController.php as it does not properly validate the CSRF token, which allows an attacker to arbitrarily delete the API key by sending a GET request to the client/delete/{id} endpoint.