Description
In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | mongo-express | <= 1.0.2 | — | GHSA-fffg-cwc9-xvj7 |
Medium · 6.1
CVE-2023-52555
EUVD-2024-0916GHSA-fffg-cwc9-xvj7
mongo-express Cross-site Request Forgery vulnerability
Published Mar 1, 2024 · Updated Aug 29, 2024 · Assigned by mitre