CVE-2023-0959

Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an ad...

Original description

The description as published by the source.

Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an administrator. This is possible because the application is vulnerable to CSRF.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

advisory fluidattacks.com
advisory github.com
advisory nvd.nist.gov
web github.com