PYSEC-2018-10

2018-04-0907:29:00

Google

osv.dev

0.001 Low

EPSS

Percentile

43.6%

JSON

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.

CPENameOperatorVersion
kottieq0.6.0b1
kottieq0.3.1
kottieq0.10b1
kottieq0.8a2
kottieq1.0.0
kottieq1.1.4
kottieq0.3.0
kottieq0.2.10
kottieq0.1a8
kottieq0.5.0a3