GHSA-gjvc-55fw-v6vq

    Dashboard / Vulnerabilities / GHSA-gjvc-55fw-v6vq

    GHSA-gjvc-55fw-v6vq

    Published: 21 Aug 2023Last Modified: 16 Feb 2024
    Aliases:
    CVE-2023-4455

    Summary: Wallabag user can delete own API client unintentionally

    Details: # Description wallabag was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete API key via `/developer/client/delete/{id}` This vulnerability has a CVSSv3.1 score of 6.5. **You should immediately patch your instance to version 2.6.3 or higher if you have more than one user and/or having open registration**. # Resolution This action is now doable only via POST method, which ensures that we can't do it via a 3rd-party website. # Credits We would like to thank @tht1997 for reporting this issue through huntr.dev. Reference: https://huntr.dev/bounties/5ab1b206-5fe8-4737-b275-d705e76f193a/

    References: https://github.com/wallabag/wallabag/security/advisories/GHSA-gjvc-55fw-v6vq, https://github.com/wallabag/wallabag/commit/ffcc5c9062fcc8cd922d7d6d65edbe5efae96806, https://github.com/wallabag/wallabag, https://huntr.dev/bounties/5ab1b206-5fe8-4737-b275-d705e76f193a

    Affected packages

    Package

    Name: wallabag/wallabag

    Purl: pkg:composer/wallabag/wallabag

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 2.0.0-alpha.1
    Fixed -2.6.3

    Affected versions

    2.0.0
    2.0.0-alpha.1
    2.0.0-alpha.2
    2.0.0-beta.1
    2.0.0-beta.2
    2.0.1
    2.0.2
    2.0.3
    2.0.4
    2.0.5
    2.0.6
    2.0.7
    2.0.8

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-gjvc-55fw-v6vq | CVE-DB