{"cve":"CVE-2022-39268","nvd":{"published":"2022-09-30T21:15:09.543","modified":"2026-06-17T04:58:02.273","status":"Modified","description":"### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can include inadvertent client or server data leakage, change of session state, or manipulation of an end user's account. ### Patch Upgrade to v2022.09.10 to patch this vulnerability. ### Workarounds Rebuild and redeploy the Orchest `auth-server` with this commit: https://github.com/orchest/orchest/commit/c2587a963cca742c4a2503bce4cfb4161bf64c2d ### References https://en.wikipedia.org/wiki/Cross-site_request_forgery https://cwe.mitre.org/data/definitions/352.html ### For more information If you have any questions or comments about this advisory: * Open an issue in https://github.com/orchest/orchest * Email us at rick@orchest.io","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":8.1},"cwes":["CWE-352"],"references":["https://github.com/orchest/orchest/commit/c2587a963cca742c4a2503bce4cfb4161bf64c2d","https://github.com/orchest/orchest/pull/1324","https://github.com/orchest/orchest/releases/tag/v2022.09.10","https://github.com/orchest/orchest/security/advisories/GHSA-q44f-8jpw-qv4j","https://github.com/orchest/orchest/commit/c2587a963cca742c4a2503bce4cfb4161bf64c2d"],"products":["orchest:orchest"],"source":"nvd","synced_at":"2026-10-19T21:36:05.460296998+00:00"},"epss":{"cve":"CVE-2022-39268","score":0.00516,"percentile":0.43965,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}