CVE-2022-0515 Cross-Site Request Forgery (CSRF) in crater-invoice/crater
Attackers can trick users into performing unintended actions in the Crater invoicing application, potentially modifying data or taking over accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-0515?
CVE-2022-0515 is a medium-severity vulnerability in crater-invoice/crater, published on 21 Mar 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.
Weakness: CWE-352
Which versions are affected by CVE-2022-0515?
It affects 1 product.
Products include Craterapp Crater.
How do I fix CVE-2022-0515?
No fix has been published for CVE-2022-0515 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-0515 being exploited?
There is no known exploitation of CVE-2022-0515 in the wild and no public exploit code.
Other vulnerabilities in crater-invoice/crater
- CVE-2021-4080 Unrestricted Upload of File with Dangerous Type in crater-invoice/crater
- CVE-2022-0372 Cross-site Scripting (XSS) - Stored in crater-invoice/crater
- CVE-2022-0203 Improper Access Control in crater-invoice/crater
- CVE-2023-46865 Code injection in n/a
- CVE-2022-1032 Insecure deserialization of not validated module file in crater-invoice/crater
Sources
Also known as GHSA-q4h7-8qhh-5p55.