Lucene search

SnykCVELIST:CVE-2020-7780

HistoryNov 27, 2020 - 12:00 a.m.

CVE-2020-7780 Cross-site Request Forgery (CSRF)

2020-11-2700:00:00

snyk

www.cve.org

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

8.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.8%

JSON

This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.

CNA Affected

[
  {
    "product": "com.softwaremill.akka-http-session:core_2.13",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "0.5.11",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "com.softwaremill.akka-http-session:core_2.12",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "0.5.11",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "com.softwaremill.akka-http-session:core_2.11",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "0.5.11",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/softwaremill/akka-http-session/commit/57f11663eecb84be03383d164f655b9c5f953b41

github.com/softwaremill/akka-http-session/issues/74

github.com/softwaremill/akka-http-session/issues/77

snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1045352

snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1046654

snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1046655