CVE-2023-7038: automad User Creation cross-site request forgery
A vulnerability was found in automad up to 1.10.9. It has been rated as problematic. This issue affects some unknown processing of the file /dashboard?controller=UserCollection::createUser of the component User Creation Handler. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248687. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Other sources
automad up to 1.10.9 does not implement anti-CSRF tokens by default, making it vulnerable Cross-Site Request Forgery (CSRF). An attacker may exploit this vulnerability to force an admin into creating or deleting users. An exploit has been disclosed publicly.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-7038?
CVE-2023-7038 has been rated as problematic.
What is the impact of CVE-2023-7038?
CVE-2023-7038 leads to cross-site request forgery during the user creation process.
How do I fix CVE-2023-7038?
To fix CVE-2023-7038, update Automad to version 2.0.0-alpha.1 or higher.
Which versions of Automad are affected by CVE-2023-7038?
CVE-2023-7038 affects Automad versions up to and including 1.10.9.
What components are involved in CVE-2023-7038?
CVE-2023-7038 involves the User Creation Handler component.