modoboa vulnerable to Cross-Site Request Forgery · CVE-2023-2228 · GitHub Advisory Database · GitHub

modoboa vulnerable to Cross-Site Request Forgery

Moderate severity GitHub Reviewed Published Apr 21, 2023 to the GitHub Advisory Database • Updated Nov 10, 2023

Package

modoboa (pip)

Affected versions

< 2.1.0

Patched versions

2.1.0

Description

modoboa prior to 2.1.0 is vulnerable to cross-site request forgery. An attacker must be logged in as admin to exploit this issue.

References

Published by the National Vulnerability Database

Apr 21, 2023

Published to the GitHub Advisory Database Apr 21, 2023

Reviewed Apr 24, 2023

Last updated Nov 10, 2023

Severity

Moderate

6.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H