{"id":"CVE-2021-4168","published":"2021-12-26T13:20:10Z","modified":"2024-08-03T17:16:04Z","title":"Cross-Site Request Forgery (CSRF) in star7th/showdoc","vendor":"star7th","product":"star7th/showdoc","tier":"tail","description":{"text":"showdoc is vulnerable to Cross-Site Request Forgery (CSRF)","provenance":"source","from":"CVE.org"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00634,"percentile":0.50411,"provenance":"source"},"cwes":[{"id":"CWE-352","name":"Cross-Site Request Forgery"}],"references":[{"url":"https://huntr.dev/bounties/f14431e2-f1f6-4331-ba91-a4ea8b26be0c","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/star7th/showdoc/commit/3ff0c85d439ccbdfadeb96b5a52acf6318041109","tags":["x_refsource_MISC"]}],"priority":{"score":14.5,"factors":[{"name":"EPSS percentile","points":10.08},{"name":"CVSS severity","points":4.41}]},"vendorSlug":"star7th","affectedVersions":[{"vendor":"star7th","product":"star7th/showdoc","versions":[">= unspecified, < 2.9.15"]}],"affected":[{"ecosystem":"Packagist","package":"showdoc/showdoc","vulnerableRanges":["<2.9.15"],"patched":["2.9.15"],"from":["GHSA-7vxc-chqj-h83g"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0508","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2021-3990","published":"2021-12-01","fixed":"2.9.13","kev":false},{"cve":"CVE-2021-3993","published":"2021-12-01","fixed":"2.9.13","kev":false},{"cve":"CVE-2021-4017","published":"2021-12-01","fixed":"2.9.13","kev":false},{"cve":"CVE-2021-4168","published":"2021-12-26","fixed":"2.9.15","kev":false},{"cve":"CVE-2022-0079","published":"2022-01-03","fixed":"2.10.0","kev":false,"link":{"from":"CVE-2021-4168","to":"CVE-2022-0079","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:showdoc/showdoc","fromFixed":"2.9.15","toFixed":"2.10.0","daysApart":8}]}},{"cve":"CVE-2021-4172","published":"2022-01-22","fixed":"2.10.2","kev":false},{"cve":"CVE-2022-0409","published":"2022-02-19","fixed":"2.10.2","kev":false}],"package":"Packagist:showdoc/showdoc"}}