{"id":"GHSA-35gp-jxw8-xw6h","aliases":["CVE-2020-14043"],"title":"Codiad CSRF Vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad v1.7.8 and later. The request to download a plugin from the marketplace is only available to admin users and it isn't CSRF protected in components/market/controller.php. This might cause admins to make a vulnerable request without them knowing and result in remote code execution. **NOTE:** the vendor states \"Codiad is no longer under active maintenance by core contributors.\"","severity":"high","score":8.8,"published":"2022-05-24T17:26:24.000Z","modified":"2024-04-25T22:43:37.199Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"codiad/codiad","sources":[{"name":"OSV · GHSA-35gp-jxw8-xw6h","url":"https://osv.dev/vulnerability/GHSA-35gp-jxw8-xw6h"}],"ranges":[{"events":[{"introduced":"1.7.8"},{"last_affected":"2.8.4"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":[]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-14043","https://github.com/Codiad/Codiad/issues/1122","https://github.com/Codiad/Codiad/issues/1132","https://github.com/Codiad/Codiad","https://web.archive.org/web/20220828222205/https://advisory.checkmarx.net/advisory/CX-2020-4279"],"sources":[{"name":"OSV","id":"GHSA-35gp-jxw8-xw6h","modified":"2024-04-25T22:43:37.199330Z","url":"https://osv.dev/vulnerability/GHSA-35gp-jxw8-xw6h"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T23:25:34.350Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}