Vulnerability Description
### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can include inadvertent client or server data leakage, change of session state, or manipulation of an end user's account. ### Patch Upgrade to v2022.09.10 to patch this vulnerability. ### Workarounds Rebuild and redeploy the Orchest `auth-server` with this commit: https://github.com/orchest/orchest/commit/c2587a963cca742c4a2503bce4cfb4161bf64c2d ### References https://en.wikipedia.org/wiki/Cross-site_request_forgery https://cwe.mitre.org/data/definitions/352.html ### For more information If you have any questions or comments about this advisory: * Open an issue in https://github.com/orchest/orchest * Email us at [email protected]
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Orchest | Orchest | >= 2022.03.7, <= 2022.09.9 |
Related Weaknesses (CWE)
References
- https://github.com/orchest/orchest/commit/c2587a963cca742c4a2503bce4cfb4161bf64cPatchThird Party Advisory
- https://github.com/orchest/orchest/pull/1324PatchThird Party Advisory
- https://github.com/orchest/orchest/releases/tag/v2022.09.10Release NotesThird Party Advisory
- https://github.com/orchest/orchest/security/advisories/GHSA-q44f-8jpw-qv4jThird Party Advisory
- https://github.com/orchest/orchest/commit/c2587a963cca742c4a2503bce4cfb4161bf64cPatchThird Party Advisory
- https://github.com/orchest/orchest/pull/1324PatchThird Party Advisory
- https://github.com/orchest/orchest/releases/tag/v2022.09.10Release NotesThird Party Advisory
- https://github.com/orchest/orchest/security/advisories/GHSA-q44f-8jpw-qv4jThird Party Advisory
FAQ
What is CVE-2022-39268?
CVE-2022-39268 is a vulnerability with a CVSS score of 8.1 (HIGH). ### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can inclu...
How severe is CVE-2022-39268?
CVE-2022-39268 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-39268?
Check the references section above for vendor advisories and patch information. Affected products include: Orchest Orchest.