Squidex
CVE-2023-0642
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
1DescriptionNVD
Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0.
AnalysisAI
Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Technical ContextAI
This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0. Affected products include: Squidex.Io Squidex. Version information: prior to 7.4.0..
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.
Server-Side Request Forgery (SSRF) vulnerability in Squidex CMS webhook configuration allows authenticated administrator
Squidex is an open source headless CMS and content management hub. Rated high severity (CVSS 7.2), this vulnerability is
Squidex is an open source headless CMS and content management hub. Rated medium severity (CVSS 6.1), this vulnerability
Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability. Rated medium severi
Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0. Rated medium severi
Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. Rated medium severity (CVSS 5.4), this
Squidex is an open source headless CMS and content management hub. Rated medium severity (CVSS 5.4), this vulnerability
Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0. Rated medium severi
Server-Side Request Forgery in Squidex versions prior to 7.23.0 allows authenticated users with asset upload permissions
Server-Side Request Forgery (SSRF) in Squidex versions before 7.23.0 allows authenticated users with schema editing perm
Server-Side Request Forgery in Squidex's backup restoration endpoint allows authenticated administrators to probe intern
Blind Server-Side Request Forgery (SSRF) in Squidex prior to version 7.23.0 allows authenticated administrators to force
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today