What is GHSA-9vxf-mcm6-5m42?

GHSA-9vxf-mcm6-5m42 is a security advisory published by GitHub Security Advisories with Medium severity. rdiffweb CSRF could lead to disabling notifications in user profile

Which CVE IDs does GHSA-9vxf-mcm6-5m42 cover?

GHSA-9vxf-mcm6-5m42 covers the following CVE IDs: CVE-2022-3233. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9vxf-mcm6-5m42?

GHSA-9vxf-mcm6-5m42 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-9vxf-mcm6-5m42?

GHSA-9vxf-mcm6-5m42 affects 1 product, including: pip/rdiffweb:\u003c 2.4.6.

GHSA-9vxf-mcm6-5m42MediumCVSS 4.3

rdiffweb CSRF could lead to disabling notifications in user profile

Vendor

GitHub Security Advisories

Published

September 22, 2022

Last Modified

October 25, 2024

🔗 CVE IDs covered (1)

CVE-2022-3233 →

📋 Description

rdiffweb prior to 2.4.6 is vulnerable to Cross-Site Request Forgery (CSRF), which could lead to disabling notifications in a user's profile.

🎯 Affected products1

pip/rdiffweb:< 2.4.6

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-3233
https://github.com/ikus060/rdiffweb/commit/18a5aabd48fa6d2d2771a25f95610c28a1a097ca
https://huntr.dev/bounties/5ec206e0-eca0-4957-9af4-fdd9185d1db3
https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-285.yaml
https://github.com/advisories/GHSA-9vxf-mcm6-5m42