CVE-2023-34927
CVE-2023-34927
Vexday Risk Score
23Low
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Proof of concept
Public proof of concept exists, but not yet automated.
CVSS —EPSS 3.1%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
22 Jun 2023Published on NVD
02 Apr 2024Public PoC
Weaponization speed
285 daysto first PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.
Affected products
n/a · n/apublic PoCs found — 3
exploitdbwww.exploit-db.com/exploits/51961unverifiedexploitdbwww.exploit-db.com/exploits/52432unverifiedexploitdbwww.exploit-db.com/exploits/52439unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.