CVE-2023-52555
MEDIUMmongo-express 1.0.2 - Cross-Site Request Forgery via Admin Endpoint
Title source: llmDescription
In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.
References (1)
Core 1
Core References
Exploit, Issue Tracking, Vendor Advisory
https://github.com/mongo-express/mongo-express/issues/1338
Scores
CVSS v3
6.1
EPSS
0.0075
EPSS Percentile
73.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-352
Status
published
Products (2)
mongo-express_project/mongo-express
1.0.2
npm/mongo-express
0npm
Published
Mar 01, 2024
Tracked Since
Feb 18, 2026