CVE-2024-55500: vulnerability facts

CVE-2024-55500

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim's machine.

CVSS 8.8 · High · EPSS 0.4%

Published: 2024-12-10T00:00:00.000Z
Updated: 2024-12-11T15:44:09.693Z

Stack: node

Affected products and versions

n/a
Versions
- n/a: Affected
No fix published
whistle npm
Affected ranges
- SEMVER: ≤ 2.9.90
No fix published

Original sources

https://github.com/avwo/whistle/commit/d1b8ca275dc4e453bd2efed392c0fd4b92f73cdf
https://www.sonarsource.com/blog/never-underestimate-csrf-why-origin-reflection-is-a-bad-idea/
https://nvd.nist.gov/vuln/detail/CVE-2024-55500

Check your server →

CVE-2024-55500

Affected products and versions

n/a

whistle npm

Original sources