GHSA-4g88-4hgm-m99x

Source

https://github.com/advisories/GHSA-4g88-4hgm-m99x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-4g88-4hgm-m99x/GHSA-4g88-4hgm-m99x.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-4g88-4hgm-m99x

Aliases

CVE-2023-45884

Published

2023-11-09T18:34:55Z

Modified

2023-11-15T17:42:19.223780Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability

Details

Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayout plugin.

Database specific

{
    "cwe_ids": [
        "CWE-352"
    ],
    "severity": "MODERATE",
    "github_reviewed_at": "2023-11-15T17:28:47Z",
    "nvd_published_at": "2023-11-09T17:15:08Z",
    "github_reviewed": true
}

References

Affected packages

npm / openmct

Package

Name: openmct; View open source insights on deps.dev
Purl: pkg:npm/openmct

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.1.1

Database specific

last_known_affected_version_range

"<= 3.1.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-4g88-4hgm-m99x/GHSA-4g88-4hgm-m99x.json"