CVE-2020-36623 Pengu index.js runApp cross-site request forgery
A cross-site request forgery vulnerability in Pengu allows remote attackers to perform unauthorized actions on behalf of authenticated users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-36623?
CVE-2020-36623 is a medium-severity vulnerability in unspecified Pengu, published on 21 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability was found in Pengu. It has been declared as problematic. Affected by this vulnerability is the function runApp of the file src/index.js. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The name of the patch is aea66f12b8cdfc3c8c50ad6a9c89d8307e9d0a91. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216475.
Which versions are affected by CVE-2020-36623?
It affects 1 product.
Products include Pengu Project Pengu.
How do I fix CVE-2020-36623?
No fix has been published for CVE-2020-36623 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36623 being exploited?
There is no known exploitation of CVE-2020-36623 in the wild and no public exploit code.
Sources
Also known as GHSA-h69c-px5j-f9xm.