CVE-2023-5519 — Cross-Site Request Forgery in Eventprime

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 63.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Metagauss Eventprime
Timeline
PublishedOct 31

Description

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-g468-f3m4-727c: The EventPrime WordPress plugin before 3↗2023-10-31
▶
CVEList
EventPrime < 3.2.0 - Booking Creation via CSRF↗2023-10-31
▶
CVE-2023-5519 — Cross-Site Request Forgery | cvebase