Is CVE-2023-45141 in the CISA KEV catalog?

No. CVE-2023-45141 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2023-45141?

CVE-2023-45141 has a CVSS v3 base score of 8.6 (HIGH).

What is the EPSS score for CVE-2023-45141?

CVE-2023-45141 has an EPSS score of 0.27% (18th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2023-45141?

Upgrade fiber to 2.50.0 or later.

CVE & CISA-KEV Catalog

CVE-2023-45141

HIGH

8.6

CVSS v3

NVD

Description

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This vulnerability has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.

CWE-352Cross-Site Request Forgery CWE-565

How to fix

Remediation Available

fiberNVD

Affected:< 2.50.0Fixed in:2.50.0CVE-2023-45141derived from NVD

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityLow

IntegrityHigh

AvailabilityLow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Exploit Intelligence

0.27%probability of exploitation in 30 days

18thpercentile

Low risk: more likely to be exploited than 18% of all known CVEs.

References

Vendor Advisory1

github.com

Embed a live status badge for CVE-2023-45141

Markdown

[![CVE-2023-45141](https://tridentstack.com/cve/badge/CVE-2023-45141.svg)](https://tridentstack.com/cve/CVE-2023-45141)

HTML

<a href="https://tridentstack.com/cve/CVE-2023-45141"><img src="https://tridentstack.com/cve/badge/CVE-2023-45141.svg" alt="CVE-2023-45141"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.