Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
apollo-portal has potential CSRF issue
Vulnerability Description
Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Vulnerability Type
跨站请求伪造(CSRF)
Vulnerability Title
Apollo 跨站请求伪造漏洞
Vulnerability Description
Apollo是Alex Breen个人开发者的一组 PHP 脚本。旨在为学生上传课程作业提供基于 Web 的界面。 Apollo 2.1.0之前版本存在安全漏洞，该漏洞源于低权限用户可以创建一个特殊的网页，管理员访问此页面就可以静默发送请求为该用户分配新角色。
CVSS Information
N/A
Vulnerability Type
N/A