{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-40172", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-08-09T15:26:41.051Z", "datePublished": "2023-08-18T21:48:42.294Z", "dateUpdated": "2023-08-18T21:48:42.294Z"}, "containers": {"cna": {"title": "Cross-Site Request Forgery (CSRF) in fobybus/social-media-skeleton", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-873h-pqjx-3pwg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-873h-pqjx-3pwg"}, {"name": "https://github.com/fobybus/social-media-skeleton/commit/344d798e82d6cc39844962c6d3cb2560f5907848", "tags": ["x_refsource_MISC"], "url": "https://github.com/fobybus/social-media-skeleton/commit/344d798e82d6cc39844962c6d3cb2560f5907848"}], "affected": [{"vendor": "fobybus", "product": "social-media-skeleton", "versions": [{"version": "< 1.0.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-08-18T21:48:42.294Z"}, "descriptions": [{"lang": "en", "value": "Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. A Cross-site request forgery (CSRF) attack is a type of malicious attack whereby an attacker tricks a victim into performing an action on a website that they do not intend to do. This can be done by sending the victim a malicious link or by exploiting a vulnerability in the website. Prior to version 1.0.5 Social media skeleton did not properly restrict CSRF attacks. This has been addressed in version 1.0.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}], "source": {"advisory": "GHSA-873h-pqjx-3pwg", "discovery": "UNKNOWN"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fobybus:social-media-skeleton:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6B65799-63F2-4F3B-B6F8-BF9DD02EAB93", "versionEndExcluding": "1.0.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. A Cross-site request forgery (CSRF) attack is a type of malicious attack whereby an attacker tricks a victim into performing an action on a website that they do not intend to do. This can be done by sending the victim a malicious link or by exploiting a vulnerability in the website. Prior to version 1.0.5 Social media skeleton did not properly restrict CSRF attacks. This has been addressed in version 1.0.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Social media skeleton es un proyecto/framework de social media sin completar implementado usando php, css, javascript y html. Un ataque de Cross-Site Request Forgery (CSRF) es un tipo de ataque malicioso mediante el cual un atacante enga\u00f1a a una v\u00edctima para que realice una acci\u00f3n en un sitio web que no tiene intenci\u00f3n de hacer. Esto puede hacerse enviando a la v\u00edctima un enlace malicioso o explotando una vulnerabilidad en el sitio web. Antes de la versi\u00f3n 1.0.5, Social Media Skeleton no restring\u00eda correctamente los ataques CSRF. Esto se ha solucionado en la versi\u00f3n 1.0.5 y se recomienda a todos los usuarios que la actualicen. No se conocen soluciones para esta vulnerabilidad. "}], "id": "CVE-2023-40172", "lastModified": "2023-08-23T19:55:36.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-08-18T22:15:11.017", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/fobybus/social-media-skeleton/commit/344d798e82d6cc39844962c6d3cb2560f5907848"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-873h-pqjx-3pwg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}