Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1mZmZnLWN3YzkteHZqN84AA5rI

mongo-express Cross-site Request Forgery vulnerability

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.

Permalink: https://github.com/advisories/GHSA-fffg-cwc9-xvj7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mZmZnLWN3YzkteHZqN84AA5rI
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 9 months ago
Updated: 3 months ago


CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-fffg-cwc9-xvj7, CVE-2023-52555
References: Repository: https://github.com/mongo-express/mongo-express
Blast Radius: 13.3

Affected Packages

npm:mongo-express
Dependent packages: 11
Dependent repositories: 153
Downloads: 6,802 last month
Affected Version Ranges: <= 1.0.2
No known fixed version
All affected versions: 0.11.0, 0.11.1, 0.11.2, 0.11.3, 0.12.0, 0.13.0, 0.14.1, 0.15.0, 0.16.1, 0.17.0, 0.17.1, 0.17.2, 0.17.3, 0.17.4, 0.17.5, 0.18.0, 0.19.0, 0.20.0, 0.21.0, 0.22.0, 0.23.0, 0.23.1, 0.23.2, 0.23.3, 0.23.4, 0.23.5, 0.23.6, 0.23.7, 0.24.0, 0.25.0, 0.26.0, 0.27.1, 0.27.2, 0.27.3, 0.27.5, 0.27.6, 0.27.7, 0.27.8, 0.28.0, 0.28.1, 0.28.2, 0.28.3, 0.28.4, 0.28.5, 0.28.6, 0.28.7, 0.28.8, 0.29.0, 0.29.1, 0.29.2, 0.29.3, 0.29.4, 0.29.5, 0.29.7, 0.29.8, 0.29.9, 0.29.10, 0.29.11, 0.29.12, 0.29.13, 0.29.14, 0.29.15, 0.29.16, 0.29.17, 0.29.18, 0.29.19, 0.29.20, 0.30.0, 0.30.1, 0.30.2, 0.30.3, 0.30.4, 0.30.6, 0.30.7, 0.30.8, 0.30.9, 0.30.10, 0.30.11, 0.30.12, 0.30.13, 0.30.14, 0.30.15, 0.30.16, 0.30.17, 0.30.18, 0.30.19, 0.30.20, 0.30.21, 0.30.22, 0.30.23, 0.30.24, 0.30.25, 0.30.26, 0.30.27, 0.30.28, 0.30.29, 0.30.31, 0.30.32, 0.30.33, 0.30.34, 0.30.35, 0.30.36, 0.30.37, 0.30.38, 0.30.39, 0.30.40, 0.30.42, 0.30.43, 0.30.44, 0.30.45, 0.30.46, 0.30.47, 0.30.48, 0.30.49, 0.30.50, 0.30.51, 0.30.52, 0.30.53, 0.30.54, 0.30.55, 0.30.56, 0.30.57, 0.30.58, 0.30.59, 0.31.0, 0.31.1, 0.31.2, 0.31.3, 0.31.4, 0.31.5, 0.32.0, 0.33.0, 0.34.0, 0.35.0, 0.37.0, 0.37.1, 0.37.2, 0.38.0, 0.39.0, 0.39.1, 0.39.2, 0.40.0, 0.41.0, 0.42.0, 0.42.1, 0.42.2, 0.42.3, 0.43.1, 0.44.0, 0.45.0, 0.46.0, 0.46.1, 0.47.0, 0.48.1, 0.49.0, 0.51.0, 0.51.1, 0.51.2, 0.52.0, 0.52.1, 0.52.2, 0.53.0, 0.54.0, 1.0.0, 1.0.1, 1.0.2