Threats tagged 'ghsa-2qjc-j63h-9f97'

Thelia versions before 3.2.0 have a cross-site request forgery (CSRF) vulnerability in the back office. This vulnerability arises because per-session CSRF tokens leak via URL query strings, allowing attackers to reuse these tokens or exploit unprotected actions. Specifically, attackers can target the setToggleVisibilityAction and updatePositionAction to perform unauthorized administrative actions such as deleting, hiding, or reordering catalogue and configuration objects.