Medium severity6.5NVD Advisory· Published Jun 22, 2023· Updated Jun 17, 2026

CVE-2023-34927

Description

Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/casdoor/casdoorGo	<= 1.331.0	—

Affected products

Casdoor/Casdoor2 versions
cpe:2.3:a:casbin:casdoor:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:casbin:casdoor:*:*:*:*:*:*:*:*range: <=1.331.0
- (no CPE)
ghsa-coords
pkg:golang/github.com/casdoor/casdoor
Range: <= 1.331.0

Patches

Vulnerability mechanics

References

github.com/casdoor/casdoor/issues/1531nvdExploitIssue TrackingThird Party AdvisoryWEB
gist.github.com/omriman067/4e90a3a4ffa40984f011d8777a995469nvdThird Party AdvisoryWEB
github.com/advisories/GHSA-rwcp-qrwg-56cgghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-34927ghsaADVISORY
casdoor.orgghsaWEB
casdoor.orgnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.002
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000