x/vulndb: potential Go vuln in github.com/casdoor/casdoor: GHSA-rwcp-qrwg-56cg

[GoVulnBot]

In GitHub Security Advisory GHSA-rwcp-qrwg-56cg, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/casdoor/casdoor		<= 1.331.0

Cross references:

• Module github.com/casdoor/casdoor appears in issue x/vulndb: potential Go vuln in github.com/casdoor/casdoor: CVE-2022-24124 #303 EFFECTIVELY_PRIVATE
• Module github.com/casdoor/casdoor appears in issue x/vulndb: potential Go vuln in github.com/casdoor/casdoor: CVE-2022-38638, GHSA-9vm3-r8gq-cr6x #1006 EFFECTIVELY_PRIVATE
• Module github.com/casdoor/casdoor appears in issue x/vulndb: potential Go vuln in github.com/casdoor/casdoor: GHSA-f93f-55c2-8c89 #1153 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/casdoor/casdoor
      versions:
        - {}
      packages:
        - package: github.com/casdoor/casdoor
summary: Casdoor Cross-Site Request Forgery vulnerability
description: Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint `/api/set-password`. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.
cves:
    - CVE-2023-34927
ghsas:
    - GHSA-rwcp-qrwg-56cg
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2023-34927
    - report: https://github.com/casdoor/casdoor/issues/1531
    - web: https://casdoor.org/
    - web: https://gist.github.com/omriman067/4e90a3a4ffa40984f011d8777a995469
    - advisory: https://github.com/advisories/GHSA-rwcp-qrwg-56cg

[zpavlinovic]

Vulnerability in tool.

[gopherbot]

Change https://go.dev/cl/505655 mentions this issue: data/excluded: add GO-2023-1868.yaml

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports