CVE-2023-46699

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user's intention.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
WESEEK, Inc.	GROWI	prior to v6.0.0

References

https://jvn.jp/en/jp/JVN18715935/Third Party Advisory
https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/Vendor Advisory
https://jvn.jp/en/jp/JVN18715935/Third Party Advisory
https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/Vendor Advisory

Timeline

Published: Dec 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-46709.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Innosa Probbys allows SQL Injection. CVE-2023-467009.8SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) CVE-2023-467015.3Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint of the Playbooks plu CVE-2023-467055.5in OpenHarmony v3.2.2 and prior versions allow a local attacker causes system information leak through type confusion.CVE-2023-467069.8Multiple MachineSense devices have credentials unable to be changed by the user or administrator.CVE-2023-467087.8in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through use after free.CVE-2023-46719.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talent Software ECOP allows Command Li CVE-2023-467114.6VR-S1000 firmware Ver. 2.37 and earlier uses a hard-coded cryptographic key which may allow an attacker to analyze the password of a specifi CVE-2023-467128.8A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attac CVE-2023-467135.3An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may al CVE-2023-467147.2A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.1 through 7.2.6 and version 7.4.0 through 7.4.1 allows CVE-2023-467154.3An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below al