What is GHSA-4j8w-p6hv-3qxc?

GHSA-4j8w-p6hv-3qxc is a security advisory published by GitHub Security Advisories with Medium severity. Cross-Site Request Forgery (CSRF) in automad/automad

Which CVE IDs does GHSA-4j8w-p6hv-3qxc cover?

GHSA-4j8w-p6hv-3qxc covers the following CVE IDs: CVE-2023-7038. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4j8w-p6hv-3qxc?

GHSA-4j8w-p6hv-3qxc has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-4j8w-p6hv-3qxc?

GHSA-4j8w-p6hv-3qxc affects 1 product, including: composer/automad/automad:\u003c 2.0.0-alpha.1.

GHSA-4j8w-p6hv-3qxcMediumCVSS 4.3

Cross-Site Request Forgery (CSRF) in automad/automad

Vendor

GitHub Security Advisories

Published

December 21, 2023

Last Modified

August 19, 2024

🔗 CVE IDs covered (1)

CVE-2023-7038 →

📋 Description

automad up to 1.10.9 does not implement anti-CSRF tokens by default, making it vulnerable Cross-Site Request Forgery (CSRF). An attacker may exploit this vulnerability to force an admin into creating or deleting users. An exploit has been disclosed publicly.

🎯 Affected products1

composer/automad/automad:< 2.0.0-alpha.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-7038
https://github.com/screetsec/VDD/tree/main/Automad%20CMS/Cross-Site%20Request%20Forgery%20(CSRF)
https://vuldb.com/?ctiid.248687
https://vuldb.com/?id.248687
https://github.com/advisories/GHSA-4j8w-p6hv-3qxc