CWE-352

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.jfinal:jfinal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-49448"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-12T00:57:30Z",
    "nvd_published_at": "2023-12-05T15:15:08Z",
    "severity": "HIGH"
  },
  "details": "JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.",
  "id": "GHSA-pv3g-vc3q-8c9g",
  "modified": "2023-12-12T00:57:30Z",
  "published": "2023-12-05T15:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49448"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ysuzhangbin/cms/blob/main/CSRF%20exists%20at%20the%20deletion%20point%20of%20navigation%20management.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-Site Request Forgery in JFinalCMS via admin/nav/delete"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.alauda.jenkins.plugins:alauda-devops-pipeline"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-16573"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-22T19:09:12Z",
    "nvd_published_at": "2019-12-17T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.",
  "id": "GHSA-pv4c-rj4h-gr9m",
  "modified": "2022-11-22T19:09:12Z",
  "published": "2022-05-24T17:03:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16573"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1600"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2019/12/17/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jenkins Alauda DevOps Pipeline Plugin vulnerable to cross-site request forgery"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:aws-credentials"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "189.v3551d5642995"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-27198"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-30T20:34:35Z",
    "nvd_published_at": "2022-03-15T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.",
  "id": "GHSA-pv4m-7c68-f4c5",
  "modified": "2023-10-27T17:02:03Z",
  "published": "2022-03-16T00:00:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27198"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/aws-credentials-plugin/commit/cbf183ce58b955f17d93fdc1ac4d19a8ebe693db"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/aws-credentials-plugin"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2351"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2022/03/15/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.xuxueli:xxl-job"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-0674"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-14T21:22:07Z",
    "nvd_published_at": "2023-02-04T08:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/updatePwd of the component New Password Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220196.",
  "id": "GHSA-pv4m-h859-jwmq",
  "modified": "2023-02-14T21:22:07Z",
  "published": "2023-02-04T09:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0674"
    },
    {
      "type": "WEB",
      "url": "https://github.com/boyi0508/xxl-job-explain/blob/main/README.md"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xuxueli/xxl-job"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.220196"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.220196"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-Site Request Forgery in XXL Job"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-4194"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-17T04:16:20Z",
    "severity": "MODERATE"
  },
  "details": "The AlT Monitoring plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the \u0027ALT_Monitoring_edit\u0027 page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
  "id": "GHSA-pv77-pr9x-9r7m",
  "modified": "2025-05-17T06:30:27Z",
  "published": "2025-05-17T06:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4194"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/alt-monitoring"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b7290317-418d-4e5c-85fa-f931cc4a865b?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-38095"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-23T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin \u003c= 4.1.3 at WordPress.",
  "id": "GHSA-pv83-hp5m-9f24",
  "modified": "2022-09-27T00:00:20Z",
  "published": "2022-09-25T00:00:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38095"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/advanced-dynamic-pricing-for-woocommerce/wordpress-advanced-dynamic-pricing-for-woocommerce-plugin-4-1-3-cross-site-request-forgery-csrf-vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/advanced-dynamic-pricing-for-woocommerce/#developers"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.38.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-345",
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:42:51Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe Budibase AI chat-link handoff flow (`GET/POST /api/chat-links/:instance/:token/handoff`) binds an **external chat identity** (Slack/Discord/MS Teams/Telegram) to a **Budibase user account**. The confirmation endpoint is on a **public route** (no CSRF middleware, no auth-group gate) and the only credential it checks is a `confirmationToken` that is **already rendered in plaintext into the HTML confirmation page** the victim views. There is no binding between the confirmation token and the requester\u0027s Budibase session at preparation time, and no CSRF token on the POST.\n\nConsequently, an attacker who creates a chat-link session for **their own** external chat identity (or any identity they can mint in their chat platform) can induce a victim Budibase user (same tenant) to submit the confirmation POST -\u003e for example by sending them a link that auto-submits, or by XSS/CSRF on a co-tenanted page -\u003e and the victim\u0027s `globalUserId` becomes bound to the attacker\u0027s external identity. The attacker then sends messages to the AI agent from their chat platform and is **acting as the victim user** inside Budibase automations/agent operations, inheriting the victim\u0027s permissions on agent operations, knowledge sources, and any downstream automation steps keyed off the linked identity.\n\n---\n\n### Affected\n\n| Component | Path | Lines |\n|---|---|---|\n| Public handoff routes (no auth-group middleware) | `packages/server/src/api/routes/chat.ts` | `23` (`GET /api/chat-links/:instance/:token/handoff`), `27` (`POST .../handoff`) |\n| Confirmation controller | `packages/server/src/api/controllers/ai/chatIdentityLinks.ts` | `124-177` (`confirmChatLinkSession`); the binding at `153-173` |\n| Confirmation token rendered into HTML | `packages/server/src/api/controllers/ai/chatIdentityLinks.ts` | `40-60` (`renderLinkConfirmationPage`); the hidden input at `55` |\n| Session creation (attacker side) | `packages/server/src/sdk/workspace/ai/chatIdentityLinks.ts` | `138-171` (`createChatIdentityLinkSession`), `173-188` (`prepareChatIdentityLinkSessionConfirmation`) |\n| Upsert of identity link | `packages/server/src/sdk/workspace/ai/chatIdentityLinks.ts` | `201-250` (`upsertChatIdentityLink`) |\n\n**Affected versions:** `master` at commit `3c8d1b4023`.\n\n**Reachable over HTTP by:** the GET and POST are on `publicRoutes` (no auth-group middleware). The POST requires `ctx.isAuthenticated` at runtime (`controllers/ai/chatIdentityLinks.ts:142`) -\u003e so the victim must be logged into Budibase when the POST fires (achievable via standard CSRF if cookies are sent cross-origin, or via phishing that lures the victim to submit).\n\n---\n\n### Root cause\n\n**Issue 1 -\u003e The handoff routes are public and unauthenticated at the middleware layer.**\n\n```ts\n// packages/server/src/api/routes/chat.ts:23, 27\npublicRoutes.get(\"/api/chat-links/:instance/:token/handoff\", ai.handoffChatLinkSession)\npublicRoutes.post(\"/api/chat-links/:instance/:token/handoff\", ai.confirmChatLinkSession)\n```\n\n`publicRoutes` has **no group middleware** (`endpointGroups/standard.ts:24-25` calls `endpointGroupList.group()` with no middleware and then `.lockMiddleware()`). The routes do not have a per-route `authorized(...)`. There is **no CSRF middleware** on these routes -\u003e Budibase\u0027s CSRF synchroniser token is enforced only for state-changing verbs on authenticated routes that are not in `NO_CSRF_ENDPOINTS`; the public-routes path bypasses it.\n\n**Issue 2 -\u003e The confirmation token is exposed to anyone who views the GET page.**\n\n```ts\n// packages/server/src/api/controllers/ai/chatIdentityLinks.ts:40-60\nconst renderLinkConfirmationPage = (session, action) =\u003e {\n  ...\n  return `\u003c!doctype html\u003e...\n    \u003cform method=\"post\" action=\"${helpers.escapeHtml(action)}\"\u003e\n      \u003cinput type=\"hidden\" name=\"confirmationToken\" value=\"${helpers.escapeHtml(session.confirmationToken)}\"\u003e\n      \u003cbutton type=\"submit\"\u003eConfirm\u003c/button\u003e\n    \u003c/form\u003e\n  ...`\n}\n```\n\nThe `confirmationToken` (a `newid()` UUIDv4 generated by `prepareChatIdentityLinkSessionConfirmation`) is rendered into a hidden form input. Anyone who loads the GET page sees the token in the page source.\n\n**Issue 3 -\u003e The POST binds the **currently-authenticated user** to the external identity based solely on the confirmation token.**\n\n```ts\n// packages/server/src/api/controllers/ai/chatIdentityLinks.ts:124-177\nexport async function confirmChatLinkSession(ctx) {\n  ...\n  if (!ctx.isAuthenticated) { throw new HTTPError(\"Authentication is required to link chat identity\", 401) }\n  if (!session.confirmationToken || ctx.request.body?.confirmationToken !== session.confirmationToken) {\n    throw new HTTPError(\"Link confirmation is invalid or has expired\", 400)\n  }\n\n  const currentGlobalUserId = getCurrentGlobalUserId(ctx)        // \u003c- victim\u0027s ID\n  const consumedSession = await sdk.ai.chatIdentityLinks.consumeChatIdentityLinkSession(token)\n  ...\n  await sdk.ai.chatIdentityLinks.upsertChatIdentityLink({\n    provider: consumedSession.provider,\n    externalUserId: consumedSession.externalUserId,              // \u003c- attacker\u0027s chat identity\n    externalUserName: consumedSession.externalUserName,\n    ...\n    globalUserId: currentGlobalUserId,                            // \u003c- bound to victim\n    linkedBy: currentGlobalUserId,\n  })\n  ...\n}\n```\n\nThere is **no binding between the session and the requester\u0027s Budibase identity at preparation time**. `prepareChatIdentityLinkSessionConfirmation` (`sdk/workspace/ai/chatIdentityLinks.ts:173-188`) stores the `confirmationToken` keyed by `token` with no user-id field. Whoever is authenticated when the POST fires (and supplies the correct `confirmationToken`) gets bound.\n\n**Issue 4 -\u003e `assertSessionMatchesInstance` only checks workspace ID, not user.**\n\n```ts\n// packages/server/src/api/controllers/ai/chatIdentityLinks.ts:17-27\nconst assertSessionMatchesInstance = ({ workspaceId, instance }) =\u003e {\n  if (!workspaceId || workspaceId !== instance) {\n    throw new HTTPError(\"Link token is not valid for this workspace\", 400)\n  }\n}\n```\n\nThe check confirms the session belongs to the same workspace as the URL `instance` param -\u003e useful for preventing cross-workspace confusion but useless against same-tenant identity confusion.\n\n---\n\n### Reproduction\n\n**Step-by-step attack**\n\n1. **Attacker (tenant T) provisions a chat-link session for their own external identity.** Via the agent channel provisioning flow (e.g. `POST /api/agent/:agentId/slack/provision` or via the Discord/MS Teams/Telegram provisioning endpoints), the attacker obtains a chat-link `token` bound to **their own** Slack user ID. The session is stored in Redis keyed by `token`, scoped to tenant T.\n\n2. **Attacker triggers `prepareChatIdentityLinkSessionConfirmation`.** Either by GETting the handoff page themselves (if they have a Budibase session) or via an internal API. The `confirmationToken` is generated and stored.\n\n3. **Attacker crafts a phishing/auto-submit page** that POSTs to `/api/chat-links/\u003cinstance\u003e/\u003ctoken\u003e/handoff` with the leaked `confirmationToken` in the body. Example:\n\n   ```html\n   \u003cform id=\"f\" method=\"post\" action=\"https://victim.budibase.app/api/chat-links/app_xxx/linktoken/handoff\"\u003e\n     \u003cinput name=\"confirmationToken\" value=\"\u003cleaked-token\u003e\"\u003e\n   \u003c/form\u003e\n   \u003cscript\u003edocument.getElementById(\u0027f\u0027).submit()\u003c/script\u003e\n   ```\n\n4. **Victim (a Budibase user in tenant T, e.g. an admin) is lured to the attacker page** while logged into Budibase. Their browser sends the POST cross-origin. If the Budibase auth cookie is sent on cross-site requests (`SameSite=Lax` by default allows top-level POST navigations, which a form-submit is), the request is authenticated as the victim.\n\n5. **The victim\u0027s `globalUserId` is now bound to the attacker\u0027s Slack identity.** When the attacker DMs the AI agent from Slack, the agent\u0027s operations run as the victim user -\u003e with the victim\u0027s permissions on agent operations, knowledge sources, file uploads, and any downstream automation steps keyed off the linked identity.\n\n**Mitigating factors:**\n- `SameSite=Lax` cookies block cross-site POSTs from sub-resources (fetch / XHR) but **allow** top-level form-POST navigations. A phishing page that submits the form via `document.form.submit()` (a top-level navigation) succeeds. So the CSRF works with the default cookie policy.\n- The attack is **same-tenant only** (`session.tenantId !== context.getTenantId()` is checked in the sdk).\n- The attacker must induce the victim to click a link (standard phishing). No silent drive-by.\n\n---\n\n### Impact\n\n| Capability | Available |\n|---|---|\n| Bind an attacker-controlled chat identity to a victim\u0027s Budibase account | \u2705 |\n| Send messages to the AI agent as the victim user (Slack/Discord/MS Teams/Telegram) | \u2705 |\n| Inherit the victim\u0027s permissions on agent operations | \u2705 |\n| Trigger automations / agent operations that the victim is authorised for | \u2705 |\n| Read knowledge sources the victim has access to | \u2705 |\n\nThe severity depends on what the agent can do as the victim. For an admin victim, this is full tenant administration via chat. For a regular user, it is impersonation within the agent subsystem. The bound identity persists until manually unlinked, so the attacker retains ongoing access.\n\nThis is a same-tenant, user-interaction-required primitive. It is below the \"unauthenticated RCE\" threshold but above \"hardening\" -\u003e it is a real authentication-confusion vulnerability on a sensitive identity-binding operation.\n\n---\n\n### Fix\n\n**Recommended layered fixes:**\n\n1. **Bind the confirmation token to the requester\u0027s Budibase session at preparation time.** In `prepareChatIdentityLinkSessionConfirmation`, store the `globalUserId` of the requester alongside the `confirmationToken`. In `confirmChatLinkSession`, verify that `getCurrentGlobalUserId(ctx)` matches the stored requester. This breaks the CSRF / cross-user confusion.\n\n2. **Add a CSRF token to the confirmation POST.** The standard Budibase CSRF synchroniser token (`x-csrf-token` header, validated against the session\u0027s `csrfToken`) should be enforced on `POST /api/chat-links/.../handoff`. Move the route out of `publicRoutes` to an authenticated route group so CSRF applies (the GET can remain public for the redirect-to-login flow; the POST should be authenticated + CSRF-protected).\n\n3. **Add a per-session nonce that is bound to the requester\u0027s browser** (e.g. a signed cookie set on the GET, validated on the POST) to prevent cross-origin submission even when `SameSite=Lax` allows it.\n\n4. **Require user re-authentication (re-entry of password / step-up auth)** for sensitive identity-binding operations, similar to how password change requires re-auth.",
  "id": "GHSA-pvcr-8mvp-w8qr",
  "modified": "2026-07-24T21:42:51Z",
  "published": "2026-07-24T21:42:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-pvcr-8mvp-w8qr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/pull/19194"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/362e6c654fb4da6e123c734333da2d6cbdcdb7ef"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/releases/tag/3.39.30"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": " Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-3604"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-02-01T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in McAfee ePO (legacy) Cloud allows unauthenticated users to perform unintended ePO actions using an authenticated user\u0027s session via unspecified vectors.",
  "id": "GHSA-pvfc-9226-rpg4",
  "modified": "2022-05-13T01:31:17Z",
  "published": "2022-05-13T01:31:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3604"
    },
    {
      "type": "WEB",
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10268"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/106830"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-39159"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-03T13:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Fraud Prevention For Woocommerce plugin \u003c=\u00a02.1.5 versions.",
  "id": "GHSA-pvg7-jvhx-fv6q",
  "modified": "2024-04-04T08:10:06Z",
  "published": "2023-10-03T15:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39159"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers/wordpress-fraud-prevention-for-woocommerce-plugin-2-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "forkcms/forkcms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-23960"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-06T22:22:33Z",
    "nvd_published_at": "2021-01-11T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user\u0027s comments, (2) restoring a deleted user, (3) installing or running modules, (4) resetting the analytics, (5) pinging the mailmotor api, (6) uploading things to the media library, (7) exporting locale.",
  "id": "GHSA-pvgf-mrr4-cw7r",
  "modified": "2021-04-06T22:22:33Z",
  "published": "2021-05-06T18:53:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-23960"
    },
    {
      "type": "WEB",
      "url": "https://github.com/forkcms/forkcms/pull/3123"
    },
    {
      "type": "WEB",
      "url": "https://www.fork-cms.com/blog/detail/fork-5.8.3-released"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-Site Request Forgery in ForkCMS"
}