{"id":"CVE-2023-45857","aliases":["CLSA-2026-1774225185","CLSA-2026-1774225186","CLSA-2026-1776991067","CLSA-2026-1782521951","CLSA-2026-1782781178","CLSA-2026-1782867613","CLSA-2026-1783040460","CLSA-2026-1783299714","CLSA-2026-1784943156","DEBIAN-CVE-2023-45857","EUVD-2023-3051","GHSA-wf5p-g6vw-rhxx","RHSA-2024:1640","UBUNTU-CVE-2023-45857"],"status":"published","title":"Axios Cross-Site Request Forgery Vulnerability","description":"An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00729,"percentile":0.54512,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-352"],"published":"2023-11-08T00:00:00Z","modified":"2026-10-28T02:30:51Z","exploits":[{"source":"pocgithub","id":"valentin-panov/CVE-2023-45857","title":"valentin-panov/CVE-2023-45857","date":"2023-10-18","url":"https://github.com/valentin-panov/CVE-2023-45857"},{"source":"pocgithub","id":"intercept6/CVE-2023-45857-Demo","title":"intercept6/CVE-2023-45857-Demo","date":"2023-10-26","url":"https://github.com/intercept6/CVE-2023-45857-Demo"},{"source":"pocgithub","id":"fuyuooumi1027/CVE-2023-45857-Demo","title":"fuyuooumi1027/CVE-2023-45857-Demo","date":"2023-11-24","url":"https://github.com/fuyuooumi1027/CVE-2023-45857-Demo"}],"fixes":[{"ecosystem":"npm","package":"axios","fixed_in":["1.6.0","0.28.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"axios","fixed_in":["0.26.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-axios","fixed_in":["1.2.1+dfsg-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-axios","fixed_in":["1.6.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-axios","fixed_in":["1.6.2+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.6.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.1"},{"fixed":"0.28.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.27.2-tuxcare.0"},{"fixed":"0.27.2-tuxcare.1"}]}],"versions":["0.27.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.1-tuxcare.0"},{"fixed":"0.18.1-tuxcare.1"}]}],"versions":["0.18.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.15.3-tuxcare.0"},{"fixed":"0.15.3-tuxcare.1"}]}],"versions":["0.15.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.2-tuxcare.0"},{"fixed":"0.19.2-tuxcare.1"}]}],"versions":["0.19.2"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21.1-tuxcare.0"},{"fixed":"0.21.1-tuxcare.1"}]}],"versions":["0.21.1"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21.4-tuxcare.0"},{"fixed":"0.21.4-tuxcare.1"}]}],"versions":["0.21.4"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0-tuxcare.0"},{"fixed":"0.24.0-tuxcare.1"}]}],"versions":["0.24.0"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.1-tuxcare.0"},{"fixed":"0.26.1-tuxcare.1"}]}],"versions":["0.26.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.0-tuxcare.0"},{"fixed":"0.26.0-tuxcare.1"}]}],"versions":["0.26.0"]},{"source":"osv","ecosystem":"Debian:12","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1+dfsg-1+deb12u1"}]}],"versions":["1.2.1+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.1"},{"fixed":"0.28.0"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.5-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.5-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0+dfsg-2","0.19.0+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.1+dfsg-1","0.23.0+dfsg-2","0.24.0+dfsg-1","0.25.0+dfsg-2","0.26.0+dfsg-1","0.26.0+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1+dfsg-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-2","1.6.8+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.9+dfsg-1","1.8.4+dfsg-1","1.11.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2+dfsg-1build1","1.16.0-1","1.18.0-1","1.19.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.2+dfsg-1build1","1.13.2+dfsg-1ubuntu0.1~esm1"]}],"products":[{"vendor":"axios","product":"axios"}],"references":[{"url":"https://github.com/axios/axios/issues/6006","tags":["x_transferred","Exploit","Issue Tracking","report","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0006/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45857","tags":["advisory"]},{"url":"https://github.com/axios/axios/issues/6022","tags":["web"]},{"url":"https://github.com/axios/axios/pull/6028","tags":["web"]},{"url":"https://github.com/axios/axios/commit/96ee232bd3ee4de2e657333d4d2191cd389e14d0","tags":["web"]},{"url":"https://github.com/axios/axios/releases/tag/v1.6.0","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459","tags":["web"]},{"url":"https://github.com/axios/axios/pull/6091","tags":["web"]},{"url":"https://github.com/axios/axios/commit/2755df562b9c194fba6d8b609a383443f6a6e967","tags":["web"]},{"url":"https://github.com/axios/axios/releases/tag/v0.28.0","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0006","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wf5p-g6vw-rhxx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45857.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-45857","tags":["advisory"]},{"url":"https://github.com/axios/axios","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1640","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247040","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2248979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2261856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2261887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2261909","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266045","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1640.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39326","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39326","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39326","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2382","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41040","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45857","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46137","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-47627","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-47627","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47627","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-49083","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49083","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a","tags":["article"]},{"url":"https://github.com/pyca/cryptography/pull/9926","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1394","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1394","tags":["advisory"]},{"url":"https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136","tags":["article"]},{"url":"https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6","tags":["article"]},{"url":"https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2660","tags":["advisory"]},{"url":"https://vuln.go.dev/ID/GO-2024-2660.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22195","tags":["advisory"]},{"url":"https://github.com/pallets/jinja/releases/tag/3.1.3","tags":["article"]},{"url":"https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23334","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23334","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23334","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23829","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23829","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23829","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8qpw-xqxj-h4r2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24680","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24680","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xxj9-f6rv-m3x4","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2024/feb/06/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-27351","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27351","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2024/mar/04/security-releases/","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2023-45857","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-45857","description":"An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.","status":"published","published":"2023-11-08T00:00:00Z","modified":"2024-09-04T15:15:16.506Z","updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-3051","description":"An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.","status":"published","published":"2023-11-08T00:00:00Z","modified":"2024-09-04T15:15:16Z","updated_at":"2026-11-03T00:56:04.589959Z"}],"ghsa":[{"id":"GHSA-wf5p-g6vw-rhxx","title":"Axios Cross-Site Request Forgery Vulnerability","description":"An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.","status":"published","published":"2023-11-08T21:30:37Z","modified":"2024-06-21T21:33:58Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:37:54.624184Z"}],"nvd":[{"id":"CVE-2023-45857","description":"An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.","status":"published","published":"2023-11-08T21:15:08.55Z","modified":"2026-06-17T06:29:40.133Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:08:43.669554Z"}],"osv":[{"id":"DEBIAN-CVE-2023-45857","description":"An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.","status":"published","published":"2023-11-08T21:15:08.55Z","modified":"2026-10-26T18:02:34.991650735Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"GHSA-wf5p-g6vw-rhxx","title":"Axios Cross-Site Request Forgery Vulnerability","description":"An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.","status":"published","published":"2023-11-08T21:30:37Z","modified":"2026-09-10T03:49:47.742398623Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"RHSA-2024:1640","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-09-30T15:52:23Z","modified":"2026-10-18T10:02:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"UBUNTU-CVE-2023-45857","description":"An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.","status":"published","published":"2023-11-08T21:15:00Z","modified":"2026-10-17T12:56:42.268816469Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"CLSA-2026-1774225185","title":"TuxCare security update for axios (2 CVEs)","description":"TuxCare rebuilt axios to address 2 CVEs. Fixed in 0.27.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:46:57.212655185Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774225186","title":"TuxCare security update for axios (5 CVEs)","description":"TuxCare rebuilt axios to address 5 CVEs. Fixed in 0.18.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:02.160008442Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776991067","title":"TuxCare security update for axios (6 CVEs)","description":"TuxCare rebuilt axios to address 6 CVEs. Fixed in 0.15.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-15T13:57:54.838790817Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1782521951","title":"TuxCare security update for axios (17 CVEs)","description":"TuxCare rebuilt axios to address 17 CVEs. Fixed in 0.19.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:51.501643897Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782781178","title":"TuxCare security update for axios (16 CVEs)","description":"TuxCare rebuilt axios to address 16 CVEs. Fixed in 0.21.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-10-15T13:57:56.893232091Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782867613","title":"TuxCare security update for axios (15 CVEs)","description":"TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.21.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-10-15T09:47:51.552498386Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1783040460","title":"TuxCare security update for axios (15 CVEs)","description":"TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.24.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:41Z","modified":"2026-10-15T13:57:55.491180345Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1783299714","title":"TuxCare security update for axios (15 CVEs)","description":"TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:42Z","modified":"2026-10-15T09:48:03.671467748Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1784943156","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 0.26.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:36.993710745Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CVE-2023-45857","description":"An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.","status":"published","published":"2023-11-08T00:00:00Z","modified":"2026-10-28T02:30:51.052642089Z","updated_at":"2026-11-02T15:44:34.287121Z"}]}}