PyPI/kotti CVE-2018-9856: unknown, EPSS 0.63%

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.

Action: Upgrade kotti to 1.3.2 or later.

pip install kotti==1.3.2

Affected

Fixed versions

Sources

• osv: PYSEC-2018-10
• https://github.com/Kotti/Kotti/issues/551
• https://github.com/advisories/GHSA-3hq4-f2v6-q338

CVE-2018-9856 · published 2018-04-09T07:29:00Z · modified 2023-11-08T04:00:30.372698Z · JSON