{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.9.90"}],"component":"whistle","cve_ids":["CVE-2024-55500"],"ecosystem":"npm","epss":0.00422,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-gg6x-448q-pqqm","id":"tcs_01M5KFRMCM906N42PGSVFSD97F","modified_at":"2024-12-10T22:57:16.748834Z","published_at":"2024-12-10T21:30:52Z","references":["https://osv.dev/vulnerability/GHSA-gg6x-448q-pqqm","https://nvd.nist.gov/vuln/detail/CVE-2024-55500","https://github.com/avwo/whistle/commit/d1b8ca275dc4e453bd2efed392c0fd4b92f73cdf","https://github.com/avwo/whistle","https://www.sonarsource.com/blog/never-underestimate-csrf-why-origin-reflection-is-a-bad-idea"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-gg6x-448q-pqqm","url":"https://osv.dev/vulnerability/GHSA-gg6x-448q-pqqm"},{"source":"nvd","source_id":"CVE-2024-55500","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55500"}],"summary":"Avenwu Whistle Cross-Site Request Forgery (CSRF)"}