6.5
CVE-2023-25015
- EPSS 0.13%
- Veröffentlicht 02.02.2023 04:15:08
- Zuletzt bearbeitet 26.03.2025 18:15:23
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginClockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Clockwork Web Project ≫ Clockwork Web Version < 0.1.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.13% | 0.333 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CWE-652 Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.