CVE-2023-0737

CVSS V2 None CVSS V3 None
Description
wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4.
Overview
  • CVE ID
  • CVE-2023-0737
  • Assigner
  • @huntr_ai
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-11-15T10:53:21.745Z
  • Last Modified Date
  • 2024-11-15T10:57:15.944Z
Weakness Enumerations
CWE URL
CWE-352 http://cwe.mitre.org/data/definitions/352.html
References
Reference URL Reference Tags
https://huntr.com/bounties/4ba20fe7-4061-4dfb-ab2f-ecaf110641a5
https://github.com/wallabag/wallabag/commit/268372dbbdd7ef87b84617fdebf95d0a86caf7dc
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-0737
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0737
History
Created Old Value New Value Data Type Notes
2024-11-16 13:08:02 Added to TrackCVE