CVE-2023-36237: Bagisto Cross-Site Request Forgery vulnerability
Bagisto Cross-Site Request Forgery vulnerability
Other sources
Cross Site Request Forgery vulnerability in Bagisto before v.1.3.2 allows an attacker to execute arbitrary code via a crafted HTML script.
— GitHub
Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/bagisto/bagistoto a version that resolves this vulnerability.Fixed in 1.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2023-36237?
CVE-2023-36237 has a high severity rating of 8.8 according to the CVSS 3.1 standards.
How do I fix CVE-2023-36237?
To fix CVE-2023-36237, upgrade Bagisto to version 1.3.2 or later, or 1.5.1 or later.
What type of vulnerability is CVE-2023-36237?
CVE-2023-36237 is a Cross Site Request Forgery (CSRF) vulnerability.
What can an attacker do with CVE-2023-36237?
An attacker can execute arbitrary code via a crafted HTML script due to CVE-2023-36237.
Which versions of Bagisto are affected by CVE-2023-36237?
CVE-2023-36237 affects Bagisto versions before 1.3.2 and 1.5.1.