HIGH 8.8 PyPI
wger Workout Manager Cross-Site Request Forgery vulnerability
GHSA-wrw3-qmqw-4x9w · CVE-2023-38759 · PYSEC-2023-144
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/reset_user_password.html, templates/user/overview.html, core/views/user.py, and templates/user/preferences.html, core/forms.py components.
Ready to move
Start Securing
Free, no credit card | First findings in minutes