CVE-2021-3775: 
PHP vulnerability analysis and mitigation

The vulnerability CVE-2021-3775 affects showdoc software and is identified as a Cross-Site Request Forgery (CSRF) vulnerability. The issue was discovered and reported in September 2021, affecting showdoc versions up to and including 2.9.12 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges, but does require user interaction. The scope is unchanged, with low impact on both confidentiality and integrity, and no impact on availability (NVD).

The CSRF vulnerability could allow attackers to perform unauthorized actions on behalf of authenticated users. The impact assessment shows potential for low-level compromise of both confidentiality and integrity of the affected system (NVD).

The vulnerability requires user interaction to be exploited, with network accessibility and low attack complexity. The CVSS metrics indicate that no special privileges are required to exploit this vulnerability (NVD).

A patch has been released to address this vulnerability, as evidenced by the commit in the showdoc repository. The fix implements strict cookie settings to prevent CSRF attacks (GitHub Patch).