CVE-2023-27295: CSRF
Published Feb 28, 2023
·Updated
Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy page that executes Javascript in an authenticated user's session when visited.
Affected Software
1 affected component
OpenCATS OpenCATS=0.9.6
Event History
Feb 28, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-27295?
CVE-2023-27295 has a medium severity rating due to its potential for cross-site request forgery attacks.
2
How do I fix CVE-2023-27295?
To fix CVE-2023-27295, ensure that CSRF tokens are required in all POST requests in the OpenCATS application.
3
What software versions are affected by CVE-2023-27295?
CVE-2023-27295 affects OpenCATS version 0.9.6 specifically.
4
Can an attacker exploit CVE-2023-27295 remotely?
Yes, an attacker can exploit CVE-2023-27295 remotely by tricking an authenticated user into visiting a malicious page.
5
What type of vulnerability is CVE-2023-27295?
CVE-2023-27295 is categorized as a cross-site request forgery vulnerability.