p PatchFirst

GHSA-56fm-hfp3-x3w3

GHSA-56fm-hfp3-x3w3 · Wallabag user can disable 2FA unintentionally

This page contains facts from public vulnerability sources. Check the original advisory before updating.

## Impact wallabag was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily disable 2FA through `/config/otp/app/disable` and `/config/otp/email/disable`. This vulnerability has a CVSSv3.1 score of 4.3. **You should upgrade your instance to version 2.6.7 or higher.** ## Resolution These endpoints now require POST method. ## Credits We would like to thank @dhina016 for reporting this issue through huntr.dev. Reference: https://huntr.dev/bounties/4c446fe7-2a44-4907-b0cf-4ab77d75c487/

CVSS 4.3 · Medium · Fix available

Published
Updated

Stack: php

Affected products and versions

  • wallabag/wallabag Packagist

    Versions
    • 2.0.0
    • 2.0.0-alpha.1
    • 2.0.0-alpha.2
    • 2.0.0-beta.1
    • 2.0.0-beta.2
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.0.6
    • 2.0.7
    • 2.0.8
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.1.6
    • 2.1.6.1
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.2.3
    • 2.3.0
    • 2.3.1
    • 2.3.2
    • 2.3.3
    • 2.3.4
    • 2.3.5
    • 2.3.6
    • 2.3.7
    • 2.3.8
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.4.3
    • 2.5.0
    • 2.5.1
    • 2.5.2
    • 2.5.3
    • 2.5.4
    • 2.6.0
    • 2.6.1
    • 2.6.2
    • 2.6.3
    • 2.6.4
    • 2.6.5
    • 2.6.6
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0-alpha.1, < 2.6.7

    Update to 2.6.7

Original sources

Check your server →