GHSA-4g88-4hgm-m99x

ghsaUSosv

NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability

view advisory published 2023-11-09Licence: CC-BY-4.0

Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayout plugin.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-45884US	medium6.5	0.33% (26th)	—	2023-11-09
Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayout plugin.

references

External citations — patches, advisories, analysis.

https://github.com/nasa/openmctPACKAGE
https://github.com/nasa/openmct/pull/7148WEB
https://github.com/nasa/openmct/pull/7148/commits/4e95e12559c9c5364269ff366a59768573baacb4WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-45884ADVISORY
https://www.linkedin.com/pulse/xss-nasas-open-mct-v302-visionspace-technologies-ubg4fWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan