Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-47635

CVE-2023-47635: Possible CSRF attack at questionnaire templates preview

4.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-47635
GHSA ID
GHSA-f3qm-vfc3-jg6v
EPSS Score
0.23821%
CWE
CWE-352
Published
2/20/2024
Updated
2/20/2024
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
decidim-templatesrubygems>= 0.23.0, < 0.27.50.27.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the 'skip_before_action' directive disabling CSRF protection for the preview endpoint. The commit diff shows this line was added in the vulnerable version and removed in the patch. The CWE-352 (CSRF) mapping and advisory details confirm this configuration error directly enables CSRF attacks on the preview functionality.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** *SR* *ut**nti*ity tok*n ****k is *urr*ntly *is**l** *or t** qu*stionn*ir* t*mpl*t*s pr*vi*w *s p*r: *ttps://*it*u*.*om/***i*im/***i*im/*lo*/****************************************/***i*im-t*mpl*t*s/*pp/*ontroll*rs/***i*im/t*mpl*t*s/**

Reasoning

T** vuln*r**ility st*ms *rom t** 'skip_***or*_**tion' *ir**tiv* *is**lin* *SR* prot**tion *or t** pr*vi*w *n*point. T** *ommit *i** s*ows t*is lin* w*s ***** in t** vuln*r**l* v*rsion *n* r*mov** in t** p*t**. T** *W*-*** (*SR*) m*ppin* *n* **visory