Lucene search
GoogleOSV:CVE-2020-28482HistoryJan 19, 2021 - 3:15 p.m.
CVE-2020-28482
2021-01-1915:15:12
Google
osv.dev
3
This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: ‘/’, sameSite: true } 2. The CSRF token was available in the GET query parameter
| CPE | Name | Operator | Version |
|---|---|---|---|
| fastify-csrf | eq | 2.0.0 | |
| fastify-csrf | eq | 1.0.4 |
Related
github
github
Cross-site Request Forgery in fastify-csrf
2021-01-20 21:30:34
veracode
veracode
Cross-site Request Forgery (CSRF)
2021-01-20 04:06:38
nvd
nvd
CVE-2020-28482
2021-01-19 15:15:12
prion
prion
Cross site request forgery (csrf)
2021-01-19 15:15:00
nodejs
nodejs
Cross-Site Request Forgery (CSRF)
2021-02-22 17:29:17
osv
osv
Cross-site Request Forgery in fastify-csrf
2021-01-20 21:30:34
cvelist
cvelist
CVE-2020-28482 Cross-site Request Forgery (CSRF)
2021-01-19 00:00:00
cve
cve
CVE-2020-28482
2021-01-19 15:15:12