CVE-2021-46252

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-15 · updated 2026-06-17
Weakness: CWE-352

Description

A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify account request requirement bypasses.

Affected products

Scratch-Wiki Scratch Confirmaccount V3: before 2022-01-04 — fixed in 2022-01-04

How to fix

Upgrade to a fixed version: Scratch-Wiki Scratch Confirmaccount V3 2022-01-04. Check the vendor advisory for mitigations.

References

https://github.com/InternationalScratchWiki/scratch-confirmaccount-v3/commit/5ed5479de0a279377aa9f64362481efb4e75d8f9
https://github.com/InternationalScratchWiki/scratch-confirmaccount-v3/pull/155
https://github.com/InternationalScratchWiki/scratch-confirmaccount-v3/commit/5ed5479de0a279377aa9f64362481efb4e75d8f9
https://github.com/InternationalScratchWiki/scratch-confirmaccount-v3/pull/155

Get alerted when CVE-2021-46252 or the next vulnerability affects your stack