medium6.1
CVE-2023-52555
mongo-express Cross-site Request Forgery vulnerability
Impact
In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | mongo-express | <= 1.0.2 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mongo-Express Project | Mongo-Express | Version 1.0.2 |