What is GHSA-gg6x-448q-pqqm?

GHSA-gg6x-448q-pqqm is a security advisory published by GitHub Security Advisories with High severity. Avenwu Whistle Cross-Site Request Forgery (CSRF)

Which CVE IDs does GHSA-gg6x-448q-pqqm cover?

GHSA-gg6x-448q-pqqm covers the following CVE IDs: CVE-2024-55500. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-gg6x-448q-pqqm?

GHSA-gg6x-448q-pqqm affects 1 product, including: npm/whistle:\u003c= 2.9.90.

GHSA-gg6x-448q-pqqmHigh

Avenwu Whistle Cross-Site Request Forgery (CSRF)

Vendor

GitHub Security Advisories

Published

December 10, 2024

Last Modified

December 10, 2024

🔗 CVE IDs covered (1)

CVE-2024-55500 →

📋 Description

Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim's machine.

🎯 Affected products1

npm/whistle:<= 2.9.90

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-55500
https://github.com/avwo/whistle/commit/d1b8ca275dc4e453bd2efed392c0fd4b92f73cdf
https://www.sonarsource.com/blog/never-underestimate-csrf-why-origin-reflection-is-a-bad-idea
https://github.com/advisories/GHSA-gg6x-448q-pqqm