high8.8
CVE-2023-38759
wger Workout Manager Cross-Site Request Forgery vulnerability
Impact
Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the `user-management` feature in the `gym/views/gym.py`, `templates/gym/reset_user_password.html`, `templates/user/overview.html`, `core/views/user.py`, and `templates/user/preferences.html`, `core/forms.py` components.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | wger | <= 2.2.0a3 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wger | Workout Manager | Version 2.2.0 |