{"id":"CVE-2023-5902","aliases":["EUVD-2023-58175","GHSA-jv2r-2rfc-r3mj"],"status":"published","title":"Cross-Site Request Forgery (CSRF) in pkp/pkp-lib","description":"Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.","severity":{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00291,"percentile":0.2185,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2023-11-01T00:00:41Z","modified":"2026-10-28T02:30:50Z","products":[{"vendor":"pkp","product":"pkp/pkp-lib"},{"vendor":"sfu","product":"pkp_web_application_library"}],"references":[{"url":"https://huntr.com/bounties/8b93c7bf-5052-424a-85cc-7e5491c61f20","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/pkp/pkp-lib/commit/2d04e770d2bbbdd899fdec382fbf2a1d4a4ffec8","tags":["x_transferred","Patch","fix"]},{"url":"https://github.com/advisories/GHSA-jv2r-2rfc-r3mj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5902.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5902","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-5902","title":"Cross-Site Request Forgery (CSRF) in pkp/pkp-lib","description":"Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.","status":"published","published":"2023-11-01T00:00:41.753Z","modified":"2025-02-27T20:37:40.078Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:35:16.771348Z"}],"euvd":[{"id":"EUVD-2023-58175","description":"Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.","status":"published","published":"2023-11-01T00:00:41Z","modified":"2025-02-27T20:37:40Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:21.469581Z"}],"ghsa":[{"id":"GHSA-jv2r-2rfc-r3mj","title":"Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.","description":"Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.","status":"published","published":"2023-11-13T15:30:20Z","modified":"2024-04-10T18:19:12Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:57:05.342619Z"}],"nvd":[{"id":"CVE-2023-5902","description":"Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.","status":"published","published":"2023-11-07T04:24:32.08Z","modified":"2026-06-17T06:49:37.363Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:08:43.669554Z"}],"osv":[{"id":"CVE-2023-5902","title":"Cross-Site Request Forgery (CSRF) in pkp/pkp-lib","description":"Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.","status":"published","published":"2023-11-01T00:00:41.753Z","modified":"2026-10-28T02:30:50.422472415Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:36.851042Z"}]}}