Lucene search
GoogleOSV:GHSA-49WP-QQ6X-G2RFHistoryJan 20, 2021 - 9:30 p.m.
Cross-site Request Forgery in fastify-csrf
2021-01-2021:30:34
Google
osv.dev
7
0.002 Low
EPSS
Percentile
59.5%
The package fastify-csrf before 3.0.0 has a set of issues that affect its ability to do CSRF protection.
- The generated cookie used insecure defaults, and did not have the httpOnly flag on:
cookieOpts: { path: '/', sameSite: true } - The CSRF token was available in the GET query parameter
| CPE | Name | Operator | Version |
|---|---|---|---|
| fastify-csrf | lt | 3.0.0 |
Related
osv
osv
CVE-2020-28482
2021-01-19 15:15:12
github
github
Cross-site Request Forgery in fastify-csrf
2021-01-20 21:30:34
veracode
veracode
Cross-site Request Forgery (CSRF)
2021-01-20 04:06:38
nvd
nvd
CVE-2020-28482
2021-01-19 15:15:12
prion
prion
Cross site request forgery (csrf)
2021-01-19 15:15:00
nodejs
nodejs
Cross-Site Request Forgery (CSRF)
2021-02-22 17:29:17
cvelist
cvelist
CVE-2020-28482 Cross-site Request Forgery (CSRF)
2021-01-19 00:00:00
cve
cve
CVE-2020-28482
2021-01-19 15:15:12