Skip to content
Fencer Vulns
medium 6.5

CVE-2023-45857 json

Axios Cross-Site Request Forgery Vulnerability

published 2023-11-08 3 y ago modified 2026-09-10 1 mo ago also GHSA-wf5p-g6vw-rhxx , EUVD-2023-3051

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Patch / fix

  • npm axios 0.28.0, 1.6.0
  • node-axios Debian 12 1.2.1+dfsg-1+deb12u1
  • node-axios Debian 14, Debian 13 1.6.2+dfsg-1

debian advisories DEBIAN-CVE-2023-45857

  • receptor ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.5-1.el8ap
  • receptor ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.5-1.el9ap
  • receptorctl ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.5-1.el8ap
  • receptorctl ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.5-1.el9ap
  • python-django ansible automation platform 2.4 4.2.11-1.el9ap
  • python-aiohttp ansible automation platform 2.4 3.9.3-1.el9ap
  • python3-django ansible automation platform 2.4 4.2.11-1.el9ap
  • python3-aiohttp ansible automation platform 2.4 3.9.3-1.el9ap

red hat advisories RHSA-2024:1640

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-45857 updated cvss 6.5

axios: exposure of confidential data stored in cookies

  • Red Hat Cryostat 2 nodejs-axios
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift Serverless nodejs-axios Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel7
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/grc-ui-rhel8 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat build of Apicurio Registry 2 nodejs-axios
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console
    affected: workaround, no fix available
  • Red Hat OpenShift Data Science (RHODS) rhods/odh-dashboard-rhel8
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Dev Spaces devspaces/code-rhel8, devspaces/traefik-rhel8
    affected: workaround, no fix available, no fix planned “Will not fix”
show 14 more
  • Red Hat Process Automation 7 nodejs-axios
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Quay 3 quay/quay-rhel8
    affected: workaround, no fix available
  • Red Hat CNV 4.12 for RHEL 8 container-native-virtualization/kubevirt-console-plugin v4.12.12-7
    fixed: vendor fix RHSA-2024:4269
  • Red Hat CNV 4.13 for RHEL 9 container-native-virtualization/kubevirt-console-plugin-rhel9 v4.13.10-387
    fixed: vendor fix RHSA-2024:5314
  • Red Hat CNV 4.14 for RHEL 9 container-native-virtualization/kubevirt-console-plugin-rhel9 v4.14.6-195
    fixed: vendor fix RHSA-2024:3473
  • Red Hat CNV 4.15 for RHEL 9 container-native-virtualization/kubevirt-console-plugin-rhel9 v4.15.2-383
    fixed: vendor fix RHSA-2024:3314
  • Red Hat CNV 4.16 for RHEL 9 container-native-virtualization/kubevirt-console-plugin-rhel9 v4.16.0-4001
    fixed: vendor fix RHSA-2024:4455
  • Red Hat Migration Toolkit for Runtimes 1 on RHEL 8
    fixed: vendor fix RHSA-2024:3920
  • Red Hat MTA 6.2 for RHEL 8 mta/mta-windup-addon-rhel9 6.2.3-2
    fixed: vendor fix RHSA-2024:3989
  • Red Hat MTA 7.0 for RHEL 9 mta/mta-ui-rhel9 7.0.3-13, mta/mta-cli-rhel9 7.0.3-16
    fixed: vendor fix RHSA-2024:3316
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower 4.5.5-2.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower 4.5.5-2.el9ap
    fixed: vendor fix RHSA-2024:1640
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 v1.8.3-4
    fixed: vendor fix RHSA-2024:1925
  • Red Hat RHACS 4.7 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.7.0-4, advanced-cluster-security/rhacs-roxctl-rhel8 4.7.0-4, advanced-cluster-security/rhacs-scanner-rhel8 4.7.0-4, advanced-cluster-security/rhacs-rhel8-operator 4.7.0-4, advanced-cluster-security/rhacs-collector-rhel8 4.7.0-3, advanced-cluster-security/rhacs-operator-bundle 4.7.0-3, +6 more
    fixed: vendor fix RHSA-2025:2876
  • Red Hat CNV 4.12 for RHEL 8 container-native-virtualization/virt-api v4.12.12-8, container-native-virtualization/virtio-win v4.12.12-5, container-native-virtualization/kubemacpool v4.12.12-5, container-native-virtualization/virt-handler v4.12.12-8, container-native-virtualization/bridge-marker v4.12.12-5, container-native-virtualization/virt-launcher v4.12.12-8, +36 more Red Hat CNV 4.13 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.13.10-12, container-native-virtualization/virtio-win-rhel9 v4.13.10-6, container-native-virtualization/kubemacpool-rhel9 v4.13.10-6, container-native-virtualization/bridge-marker-rhel9 v4.13.10-6, container-native-virtualization/virt-handler-rhel9 v4.13.10-12, container-native-virtualization/ovs-cni-plugin-rhel9 v4.13.10-6, +39 more Red Hat CNV 4.14 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.14.6-3, container-native-virtualization/pr-helper-rhel9 v4.14.6-3, container-native-virtualization/virtio-win-rhel9 v4.14.6-1, container-native-virtualization/kubemacpool-rhel9 v4.14.6-1, container-native-virtualization/mtq-operator-rhel9 v4.14.6-1, container-native-virtualization/virt-handler-rhel9 v4.14.6-3, +37 more Red Hat CNV 4.15 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.15.2-9, container-native-virtualization/pr-helper-rhel9 v4.15.2-9, container-native-virtualization/virtio-win-rhel9 v4.15.2-2, container-native-virtualization/aaq-server-rhel9 v4.15.2-17, container-native-virtualization/kubemacpool-rhel9 v4.15.2-2, container-native-virtualization/mtq-operator-rhel9 v4.15.2-4, +43 more Red Hat CNV 4.16 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.16.0-297, container-native-virtualization/pr-helper-rhel9 v4.16.0-298, container-native-virtualization/wasp-agent-rhel9 v4.16.0-39, container-native-virtualization/aaq-server-rhel9 v4.16.0-114, container-native-virtualization/virtio-win-rhel9 v4.16.0-130, container-native-virtualization/kubemacpool-rhel9 v4.16.0-112, +47 more Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8
    +10 more products
    Red Hat Migration Toolkit for Applications 6 mta/mta-ui-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-console-plugin-rhel9 Red Hat MTA 6.2 for RHEL 8 mta/mta-ui-rhel9 6.2.3-2, mta/mta-hub-rhel9 6.2.3-1, mta/mta-rhel8-operator 6.2.3-1, mta/mta-operator-bundle 6.2.3-4, mta/mta-pathfinder-rhel9 6.2.3-1 Red Hat MTA 7.0 for RHEL 8 mta/mta-rhel8-operator 7.0.3-7 Red Hat MTA 7.0 for RHEL 9 mta/mta-hub-rhel9 7.0.3-10, mta/mta-operator-bundle 7.0.3-25, mta/mta-windup-shim-rhel9 7.0.3-12, mta/mta-analyzer-lsp-rhel9 7.0.3-13, mta/mta-analyzer-addon-rhel9 7.0.3-13 Red Hat Multicluster Engine for Kubernetes multicluster-engine/multicluster-engine-console-mce-rhel9 Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel8 Red Hat Ansible Automation Platform 1.2 ansible-tower
    not affected: vulnerable code not present

13 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-277-02 updated cvss 6.5

Subnet Solutions Inc. PowerSYSTEM Center

  • Subnet Solutions Inc. PowerSYSTEM Center <=PSC_2020_v5.21.x
    affected: vendor fix, mitigation “For all vulnerabilities, users can disable usage of previous UI extensions.” subnet.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/axios/axios/issues/6006 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm axios
>=1.0.0, <1.6.0
>=0.8.1, <0.28.0
1.6.0
0.28.0

Classification

Weakness
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.