Vulnerability Database

296,702

Total vulnerabilities in the database

CVE-2023-34927

Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.

Published: Jun 22, 2023
Updated: May 9, 2024
CVE: CVE-2023-34927
GHSA: GHSA-rwcp-qrwg-56cg
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWEs:

CWE-352

Affected Software
References

Software	From	Fixed in
github.com/casdoor/casdoor	-	1.331.0.x
casbin / casdoor	-	1.331.0.x

https://casdoor.org
https://casdoor.org/
https://gist.github.com/omriman067/4e90a3a4ffa40984f011d8777a995469
https://github.com/casdoor/casdoor/issues/1531

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo