CVE-2023-4454: Cross-Site Request Forgery (CSRF) in wallabag/wallabag
Description
wallabag was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily reset annotations, entries and tags, by the GET request to /reset/annotations, /reset/entries, /reset/tags, /reset/archived.
This vulnerability has a CVSSv3.1 score of 4.3.
You should immediately patch your instance to version 2.6.3 or higher if you have more than one user and/or having open registration.
Resolution
These actions are now doable only via POST method, which ensures that we can't do them via a 3rd-party website.
Credits
We would like to thank @zpbrent for reporting this issue through huntr.dev.
Reference: https://huntr.dev/bounties/4ee0ef74-e4d4-46e7-a05c-076bce522299/
Other sources
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-4454?
CVE-2023-4454 is a Cross-Site Request Forgery (CSRF) vulnerability in the wallabag/wallabag GitHub repository prior to version 2.6.3.
What is the severity of CVE-2023-4454?
CVE-2023-4454 has a severity score of 5.7 (medium).
How does CVE-2023-4454 affect wallabag?
CVE-2023-4454 allows attackers to reset annotations, entries, and tags in wallabag by making specific GET requests.
How can I fix CVE-2023-4454?
To fix CVE-2023-4454, you need to update wallabag/wallabag to version 2.6.3.
Where can I find more information about CVE-2023-4454?
More information about CVE-2023-4454 can be found in the GitHub security advisory and commit links provided.