CVE-2023-34927

Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password

published June 22, 2023

CVSS
—
EPSS
3%
Percentile
87.5
In the wild
Unconfirmed
What it is

Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03067 · 87.5th percentile
Published
2023-06-22T00:00Z
EPSS history
Timeline
  • 22 JUN 00:00Z
    Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password
    cvelistv5