{"action":"Upgrade kotti to 1.3.2 or later.","affected":[{"fixed":"1.3.2","introduced":"0"}],"component":"kotti","cve_ids":["CVE-2018-9856"],"ecosystem":"PyPI","epss":0.00633,"exploited":false,"fixed_versions":["1.3.2"],"ghsa_id":"GHSA-3hq4-f2v6-q338","id":"tcs_01M5KG7N212GHQXFR695Y9M8VG","modified_at":"2023-11-08T04:00:30.372698Z","published_at":"2018-04-09T07:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2018-10","https://github.com/Kotti/Kotti/issues/551","https://github.com/advisories/GHSA-3hq4-f2v6-q338"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2018-10","url":"https://osv.dev/vulnerability/PYSEC-2018-10"}],"summary":"Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request."}