@cromwell/admin-panel (>=1.1.3, <=2.1.8), @cromwell/cms (>=1.1.7, <=2.1.12) +5 more potentially affected by CVE-2021-22963 via fastify-static (>=4.0.1, <=4.2.3)

fastify-static NPM version =4.0.1, =1.1.3, =1.1.7, =1.31.0, =1.39.28, =4.41.2-test.1, =3.4.0, =3.6.0-beta.3 Source cves: CVE-2021-22963 Source advisory: OSV:GHSA-P6VG-P826-QP3V...

URL Redirection to Untrusted Site ('Open Redirect') in fastify-static

Impact A redirect vulnerability in the fastify-static module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e. The issue shows up on all the fastify-static applications that set...

GHSA-P6VG-P826-QP3V URL Redirection to Untrusted Site ('Open Redirect') in fastify-static

Impact A redirect vulnerability in the fastify-static module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e. The issue shows up on all the fastify-static applications that set...

Fastify: Open redirect in fastify-static via mishandled user's input when attempt to redirect

Summary: When fastify-static is mounted at root and the register option redirect: true, the following 2 lines cause open redirect bug: https://github.com/fastify/fastify-static/blob/master/index.jsL156-L157. A remote attackers can redirect users to arbitrary web sites via a double forward slash:...

CVE-2021-29624

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service...

CVE-2021-29624

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service...

Cross site request forgery (csrf)

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service...

CVE-2021-29624 Lack of protection against cookie tossing attacks in fastify-csrf

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service...

CVE-2021-29624

CVE-2021-29624 concerns fastify-csrf. Older releases (pre-3.1.0) use a double-submitted cookie CSRF mechanism across subdomains, which is addressed in 3.1.0. The vulnerability involves the optional userInfo parameter that binds the CSRF token to the user; if userInfo is missing or predictable, ne...

Cross-site Request Forgery (CSRF)

fastify-csrf is vulnerable to Cross-site Request Forgery CSRF. The vulnerability exists when fastify-csrf is used with the "double submit" mechanism using cookies with an application deployed across multiple subdomains...

Fastify 跨站请求伪造漏洞

Fastify is an open source web framework for Node.js from the OpenJS Openjs Foundation. Node.js fastify suffers from a security vulnerability that allows an attacker to trigger cross-site request forgery via Cookie Double Submit in Node.js fastify-csrf in order to force the victim to perform an...

cookie tossing attack

Overview Users that used fastify-csrf with the "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Recommendation Upgrade to version 3.1.0 or later References - CVE - GitHub Advisory...

Lack of protection against cookie tossing attacks in fastify-csrf

Impact Users that used fastify-csrf with the "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Patches Version 3.1.0 of the fastify-csrf fixes it. See https://github.com/fastify/fastify-csrf/pull/51 and...

GHSA-RC4Q-9M69-GQP8 Lack of protection against cookie tossing attacks in fastify-csrf

Impact Users that used fastify-csrf with the "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Patches Version 3.1.0 of the fastify-csrf fixes it. See https://github.com/fastify/fastify-csrf/pull/51 and...

PT-2021-18374 · Unknown · Fastify-Csrf

Name of the Vulnerable Software and Affected Versions: fastify-csrf versions prior to 3.1.0 Description: The issue affects applications using the fastify-csrf plugin with the "double submit" mechanism, particularly those deployed across multiple subdomains. To fully implement protection, users of...

Uncontrolled Resource Consumption in fastify-multipart

Prototype pollution vulnerability in fastify-multipart 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request...

GHSA-P9F8-GQJF-M75J Uncontrolled Resource Consumption in fastify-multipart

Prototype pollution vulnerability in fastify-multipart 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.2.2 security and bug fix update

Red Hat Advanced Cluster Management for Kubernetes 2.2.2 General Availability release images, which fix several bugs and security issues. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

CVE-2021-21321

A flaw was found in fastify-reply-from. Escaping of the prefix of the proxied backend service is possible allowing an attacker, using a specially crafted URL, to gain access to directories that would otherwise be out of bounds. The highest threat from this vulnerability is to data confidentiality...

CVE-2021-21322

A flaw was found in fastify-http-proxy. Escaping the prefix of the proxied backend service is possible by an attacker using a specially crafted URL. The highest threat from this vulnerability is to data confidentiality and integrity...