CVE-2023-45857
mediumpriority · track · 36EPSS 0.006 · 46 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-22
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedPowerSYSTEM Centercisa_csaf_ot
For CVE-2020-28168 and CVE-2023-45857, users can limit outbound connection requests from the PowerSYSTEM Center security zone to external websites.
- MitigationPowerSYSTEM Centercisa_csaf_ot
For all vulnerabilities, users can disable usage of previous UI extensions.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (3)
Public proof-of-concept and weaponised exploit code.
- fuyuooumi1027/CVE-2023-45857-Demofuyuooumi1027/CVE-2023-45857-DemoPoC · poc_in_github
- intercept6/CVE-2023-45857-DemoCVE-2023-45857の挙動を確認するデモPoC · poc_in_github
- valentin-panov/CVE-2023-45857valentin-panov/CVE-2023-45857PoC · poc_in_github
affected products (49)
Products and version ranges known to be affected.
- Red Hat Enterprise Linux Advanced Cluster Security for Kubernetes 4all versionscert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_security_for_kubernetes_4
- Red Hat OpenShift CodeReady Workspacesall versionscert_bundDEcpe:/a:redhat:openshift:codeready_workspaces
- Red Hat OpenShift Custom Metric Autoscaler 2all versionscert_bundDEcpe:/a:redhat:openshift:custom_metric_autoscaler_2
- Red Hat OpenShift Kube Descheduler Operator 5all versionscert_bundDEcpe:/a:redhat:openshift:kube_descheduler_operator_5
advisories (6)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-0277IBM Business Automation Workflow: Mehrere SchwachstellenDeutsch2024-02-01csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten, einen Phishing-Angriff durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
- WID-SEC-W-2024-0588IBM App Connect Enterprise: Schwachstelle ermöglicht Cross-Site Request ForgeryDeutsch2024-03-07csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um Cross-Site-Scripting-Angriffe, Web-Cache-Poisoning und andere bösartige Aktivitäten durchzuführen
- WID-SEC-W-2024-1226Red Hat OpenShift: Mehrere SchwachstellenDeutsch2024-05-22csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Dateien zu manipulieren, einen Denial-of-Service-Zustand zu verursachen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern oder um weitere nicht spezifizierte Angriffe auszuführen.
- WID-SEC-W-2024-3344HCL BigFix WebUI: Mehrere Open Source SchwachstellenDeutsch2024-11-05csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in HCL BigFix WebU ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität zu gefährden.
- GHSA-wf5p-g6vw-rhxxAxios Cross-Site Request Forgery Vulnerability2023-11-08ghsa · osvUS
An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
- ICSA-24-277-02Subnet Solutions Inc. PowerSYSTEM Center2024-10-01icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could result in an attacker bypassing a proxy, creating a denial-of-service condition, or viewing sensitive information.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2023-45857cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-45857/cnnvd
- https://github.com/axios/axios/releases/tag/v1.6.0Patchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2023-45857cnnvd
- https://vigilance.fr/vulnerability/Axios-information-disclosure-via-HTTP-Header-X-XSRF-TOKEN-43951cnnvd
- https://www.auscert.org.au/bulletins/ESB-2024.0731cnnvd
- https://github.com/axios/axios/issues/6006enisa_euvd
- https://security.netapp.com/advisory/ntap-20240621-0006/enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan