id: PYSEC-2023-144
modified: 2023-08-17T03:22:34.520767Z
published: 2023-08-08T16:15:00Z
aliases:
- CVE-2023-38759
- GHSA-wrw3-qmqw-4x9w
details: Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout
  Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management
  feature in the gym/views/gym.py, templates/gym/reset_user_password.html, templates/user/overview.html,
  core/views/user.py, and templates/user/preferences.html, core/forms.py components.
affected:
- package:
    ecosystem: PyPI
    name: wger
    purl: pkg:pypi/wger
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
  versions:
  - "1.1"
  - 1.1.1
  - "1.2"
  - 1.2rc1
  - "1.3"
  - "1.4"
  - "1.5"
  - "1.6"
  - 1.6.1
  - "1.7"
  - "1.8"
  - "1.9"
  - "2.0"
  - "2.1"
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
references:
- type: WEB
  url: https://github.com/0x72303074/CVE-Disclosures
- type: WEB
  url: https://wger.de
- type: ADVISORY
  url: https://github.com/advisories/GHSA-wrw3-qmqw-4x9w