{"id":"GHSA-4j8w-p6hv-3qxc","aliases":["CVE-2023-7038"],"title":"Cross-Site Request Forgery (CSRF) in automad/automad","description":"automad up to 1.10.9 does not implement anti-CSRF tokens by default, making it vulnerable Cross-Site Request Forgery (CSRF). An attacker may exploit this vulnerability to force an admin into creating or deleting users. An exploit has been disclosed publicly.","severity":"medium","score":4.3,"published":"2023-12-21T18:30:23.000Z","modified":"2024-08-19T21:09:50.488Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"automad/automad","ranges":[{"events":[{"introduced":"0"},{"fixed":"2.0.0-alpha.1"}],"type":"ECOSYSTEM"}],"versions":["1.10.9"],"fixed":["2.0.0-alpha.1"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2023-7038","https://github.com/marcantondahmen/automad","https://github.com/screetsec/VDD/tree/main/Automad%20CMS/Cross-Site%20Request%20Forgery%20(CSRF)","https://vuldb.com/?ctiid.248687","https://vuldb.com/?id.248687"],"sources":[{"name":"OSV","id":"GHSA-4j8w-p6hv-3qxc","modified":"2024-08-19T21:09:50.488272Z","url":"https://osv.dev/vulnerability/GHSA-4j8w-p6hv-3qxc"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","score":4.3}]}