{"action":"Upgrade github.com/filebrowser/filebrowser/v2 to 2.18.0 or later.","affected":[{"fixed":"2.18.0","introduced":"0"}],"component":"github.com/filebrowser/filebrowser/v2","cve_ids":["CVE-2021-46398"],"ecosystem":"Go","epss":0.06717,"exploited":false,"fixed_versions":["2.18.0"],"ghsa_id":"GHSA-72wf-hwcq-65h9","id":"tcs_01M5KF16J9RPS9MXRDJ58WH588","modified_at":"2024-05-20T21:22:49Z","published_at":"2022-02-05T00:00:31Z","references":["https://osv.dev/vulnerability/GHSA-72wf-hwcq-65h9","https://nvd.nist.gov/vuln/detail/CVE-2021-46398","https://github.com/filebrowser/filebrowser/issues/1621","https://github.com/filebrowser/filebrowser/commit/74b7cd8e81840537a8206317344f118093153e8d","https://febin0x4e4a.blogspot.com/2022/01/critical-csrf-in-filebrowser.html","https://febin0x4e4a.wordpress.com/2022/01/19/critical-csrf-in-filebrowser","https://febinj.medium.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7","https://github.com/filebrowser/filebrowser","https://pkg.go.dev/vuln/GO-2022-0563","https://systemweakness.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7","http://packetstormsecurity.com/files/165885/FileBrowser-2.17.2-Code-Execution-Cross-Site-Request-Forgery.html"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-72wf-hwcq-65h9","url":"https://osv.dev/vulnerability/GHSA-72wf-hwcq-65h9"}],"summary":"Cross-Site Request Forgery in Filebrowser"}