high8.7
CVE-2024-55500
Avenwu Whistle Cross-Site Request Forgery (CSRF)
Impact
Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim's machine.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | whistle | <= 2.9.90 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/avwo/whistle/commit/d1b8ca275dc4e453bd2efed392c0fd4b92f73cdf
- https://www.sonarsource.com/blog/never-underestimate-csrf-why-origin-reflection-is-a-bad-idea/
- https://github.com/advisories/GHSA-gg6x-448q-pqqm
- https://nvd.nist.gov/vuln/detail/CVE-2024-55500
- https://www.sonarsource.com/blog/never-underestimate-csrf-why-origin-reflection-is-a-bad-idea