CVE-2018-9856

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2018-04-09

Last modified

2024-09-16

Weaknesses

CWE-352

Affected products

• Kotti (Kotti Project)

References

• https://github.com/Kotti/Kotti/issues/551