GHSA-rwcp-qrwg-56cgMediumCVSS 6.5

Casdoor Cross-Site Request Forgery vulnerability

Published
June 22, 2023
Last Modified
November 12, 2023

🔗 CVE IDs covered (1)

CVE-2023-34927 →

📋 Description

Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.

🎯 Affected products1

  • go/github.com/casdoor/casdoor:<= 1.331.0

🔗 References (5)