Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS00Zzg4LTRoZ20tbTk5eM4AA3BK

NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayout plugin.

Permalink: https://github.com/advisories/GHSA-4g88-4hgm-m99x
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00Zzg4LTRoZ20tbTk5eM4AA3BK
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: about 1 year ago


CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS Percentage: 0.0007
EPSS Percentile: 0.31988

Identifiers: GHSA-4g88-4hgm-m99x, CVE-2023-45884
References: Repository: https://github.com/nasa/openmct
Blast Radius: 10.1

Affected Packages

npm:openmct
Dependent packages: 1
Dependent repositories: 36
Downloads: 787 last month
Affected Version Ranges: <= 3.1.0
Fixed in: 3.1.1
All affected versions: 0.11.4, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.6.0, 1.6.1, 1.6.2, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 3.0.2, 3.1.0
All unaffected versions: 3.1.1, 3.2.0, 3.2.1, 4.0.0