fix(deps) CVE–2023–45857 (bump axios)

[debricked]

CVE–2023–45857

Vulnerability details

Description

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

NVD

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

GitHub

Axios Cross-Site Request Forgery Vulnerability

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

CVSS details - 6.5

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity	None
Availability	None

References

    Axios Cross-Site Request Forgery Vulnerability · CVE-2023-45857 · GitHub Advisory Database · GitHub
    NVD - CVE-2023-45857
    CVE-2023-45857 (CWE-359) XSRF-TOKEN value is disclosed to an unauthorised actor · Issue #6006 · axios/axios · GitHub
    fix(CSRF): fixed CSRF vulnerability CVE-2023-45857 (#6028) · axios/axios@96ee232 · GitHub
    Release Release v1.6.0 · axios/axios · GitHub
    CSRF vulnerability in AXIOS 0.24.1 to latest · Issue #6022 · axios/axios · GitHub
    Cross-site Request Forgery (CSRF) in axios | CVE-2023-45857 | Snyk
    CVE 2023 45857 by valentin-panov · Pull Request #6028 · axios/axios · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE

 

[cloudflare-pages]

Deploying with    Cloudflare Pages

Latest commit:	436866e
Status:	✅  Deploy successful!
Preview URL:	https://d3c4dc41.immich.pages.dev
Branch Preview URL:	https://debricked-fix-cve-2023-45857.immich.pages.dev

View logs