CVE-2023-2307 - Vulnerability Details - OpenCVE

Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Builder	Qwik

Configuration 1 [-]

cpe:2.3:a:builder:qwik:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/BuilderIO/qwik/pull/3862/commits/09190b70027354baf7ad3d208df9c05a87f75f57
https://huntr.dev/bounties/204ea12e-9e5c-4166-bf0e-fd49c8836917

History

No history.

MITRE

Status: PUBLISHED

Assigner: @huntrdev

Published: 2023-04-26T00:00:00

Updated: 2024-08-02T06:19:14.824Z

Reserved: 2023-04-26T00:00:00

Link: CVE-2023-2307

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-04-26T17:15:11.217

Modified: 2024-11-21T07:58:21.303

Link: CVE-2023-2307

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-2307", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "assignerShortName": "@huntrdev", "dateUpdated": "2024-08-02T06:19:14.824Z", "dateReserved": "2023-04-26T00:00:00", "datePublished": "2023-04-26T00:00:00"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "builderio/qwik", "vendor": "builderio", "versions": [{"lessThan": "0.104.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.</p>"}], "value": "Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev", "dateUpdated": "2023-10-10T07:23:10.021Z"}, "references": [{"url": "https://huntr.dev/bounties/204ea12e-9e5c-4166-bf0e-fd49c8836917"}, {"url": "https://github.com/BuilderIO/qwik/pull/3862/commits/09190b70027354baf7ad3d208df9c05a87f75f57"}], "source": {"advisory": "204ea12e-9e5c-4166-bf0e-fd49c8836917", "discovery": "EXTERNAL"}, "title": "Cross-Site Request Forgery (CSRF) in builderio/qwik", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:19:14.824Z"}, "title": "CVE Program Container", "references": [{"url": "https://huntr.dev/bounties/204ea12e-9e5c-4166-bf0e-fd49c8836917", "tags": ["x_transferred"]}, {"url": "https://github.com/BuilderIO/qwik/pull/3862/commits/09190b70027354baf7ad3d208df9c05a87f75f57", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:builder:qwik:*:*:*:*:*:*:*:*", "matchCriteriaId": "1853709E-692C-4325-BEBD-D56495DED1C2", "versionEndExcluding": "0.104.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.\n\n"}], "id": "CVE-2023-2307", "lastModified": "2024-11-21T07:58:21.303", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@huntr.dev", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-04-26T17:15:11.217", "references": [{"source": "security@huntr.dev", "tags": ["Patch"], "url": "https://github.com/BuilderIO/qwik/pull/3862/commits/09190b70027354baf7ad3d208df9c05a87f75f57"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/204ea12e-9e5c-4166-bf0e-fd49c8836917"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/BuilderIO/qwik/pull/3862/commits/09190b70027354baf7ad3d208df9c05a87f75f57"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/204ea12e-9e5c-4166-bf0e-fd49c8836917"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@huntr.dev", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}