Description
Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.
Remediation
References
https://nodesecurity.io/advisories/91
Related Vulnerabilities
CVE-2021-41862 Vulnerability in maven package com.googlecode.aviator:aviator
CVE-2020-7630 Vulnerability in npm package git-add-remote
CVE-2023-26487 Vulnerability in maven package org.webjars.npm:vega-functions
CVE-2020-13935 Vulnerability in maven package org.apache.tomcat:tomcat-websocket
CVE-2021-41182 Vulnerability in maven package org.webjars:jquery-ui