6.5

CVE-2023-34927: casbin casdoor Cross-Site Request Forgery (CSRF)

CVSS: 6.5v3.1MediumModified
AliasesGHSA-rwcp-qrwg-56cg
Published 22-06-2023Last modified 04-12-2024
Open JSON

Vulnerability summary

CVE-2023-34927 is a medium (CVSS 6.5) Cross-Site Request Forgery (CSRF) vulnerability in casbin casdoor. EPSS estimates a 3.07% chance of exploitation in the next 30 days, higher than 87.4% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk
37/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (NVD)
EPSS score
3.07%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits4github, exploit-database

Timeline

  1. 22-06-2023
    PublishedVulnerability first disclosed.
  2. 04-12-2024
    Last modifiedVulnerability information updated.

Description

Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

3.07%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

0.00 pp

From 3.07% on 19-09-2026

19-09-202619-10-2026
EPSS score
3.07%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found
  • githubUnverified

    Casdoor

    Maturity: poc

  • exploit-databasegoUnverified

    Casdoor < v1.331.0 - '/api/set-password' CSRF

    Maturity: poc

  • exploit-databasemultipleUnverified

    Casdoor 2.55.0 - Cross-Site Request Forgery (CSRF)

    Maturity: poc

Show all 4 exploits
  • exploit-databasemultipleUnverified

    Casdoor 2.95.0 - Cross-Site Request Forgery (CSRF)

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Casbin1 product
Github.com/casdoor1 product
  • casdoor≤ 1.331.0

2 vendors · 2 products

References

6 links