1 line
2.4 KiB
JSON
1 line
2.4 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-p69g-f978-xxv9","published":"2018-12-20T22:01:39Z","modified":"2024-09-30T17:01:01.119720Z","aliases":["CVE-2018-1000843","PYSEC-2018-11"],"summary":"Cross-Site Request Forgery (CSRF) in Luigi","details":"Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery (CSRF) vulnerability in API endpoint: /api/<method> that can result in Task metadata such as task name, id, parameter, etc. will be leaked to unauthorized users. This attack appear to be exploitable via The victim must visit a specially crafted webpage from the network where their Luigi server is accessible.. This vulnerability appears to have been fixed in 2.8.0 and later.","affected":[{"package":{"name":"luigi","ecosystem":"PyPI","purl":"pkg:pypi/luigi"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0"}]}],"versions":["1.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.23","1.0.24","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.2","1.2.1","1.3.0","2.0.0","2.0.1","2.1.0","2.1.1","2.2.0","2.3.0","2.3.1","2.3.2","2.3.3","2.4.0","2.5.0","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/12/GHSA-p69g-f978-xxv9/GHSA-p69g-f978-xxv9.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000843"},{"type":"WEB","url":"https://github.com/spotify/luigi/pull/1870"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-p69g-f978-xxv9"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/luigi/PYSEC-2018-11.yaml"},{"type":"PACKAGE","url":"https://github.com/spotify/luigi"},{"type":"WEB","url":"https://github.com/spotify/luigi/blob/2.7.9/luigi/server.py#L67"},{"type":"WEB","url":"https://groups.google.com/forum/#!topic/luigi-user/ZgfRTpBsVUY"}],"database_specific":{"cwe_ids":["CWE-352"],"github_reviewed":true,"github_reviewed_at":"2020-06-16T21:48:19Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]} |