CVE-2023-34927

MediumCVSS 6.5

Published: 22/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.72%

75th percentile - higher than 75% of all known CVEs

Summary

Casdoor v1.331.0 and below was found to contain a Cross-Site Request Forgery (CSRF) vulnerability in the /api/set-password endpoint. This vulnerability allows attackers to arbitrarily change the victim user's password by supplying a crafted URL.

Risk Assessment

This vulnerability poses a risk of unauthorized password changes for users, potentially leading to account takeover and data loss.

Recommendation

It is recommended to upgrade to the latest version of Casdoor and implement additional security measures against CSRF attacks.

Original NVD description (English source)

Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.