Cross-Site Request Forgery (CSRF)

github.com/gofiber/fiber is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to improper validation and enforcement of CSRF tokens within the application. An attacker is able to exploit this vulnerability by tricking a user into clicking on a malicious link or by sending a...

CVE-2023-45141

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the...

CVE-2023-45128

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to injec...

Cross site request forgery (csrf)

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the...

CVE-2023-45141 CSRF Token Validation Vulnerability in fiber

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the...

CVE-2023-45141 CSRF Token Validation Vulnerability in fiber

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the...

CVE-2023-45141

CVE-2023-45141 affects the Go framework fiber (Fiber). The CSRF token validation vulnerability arises from improper validation/enforcement of CSRF tokens, with tokens not tied to the original requester allowing token reuse and forged actions. Affected data paths include token handling in fiber/v2...

CVE-2023-45128 CSRF Token Reuse Vulnerability in fiber

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to injec...

CVE-2023-45128 CSRF Token Reuse Vulnerability in fiber

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to injec...

CVE-2023-45128

CVE-2023-45128 affects the Fiber (Go) web framework. The CSRF flaw stems from improper validation/enforcement of CSRF tokens, enabling forged requests without authentication and potentially impacting user actions and data. The issue is addressed in Fiber v2.50.0; upgrading to that version (or lat...

Fiber Security Breach

Fiber is an open source web framework written in the Go language. A security vulnerability exists in Fiber that stems from the presence of a cross-site request forgery CSRF vulnerability. The vulnerability can be exploited by an attacker to obtain a token instead of the user and forge malicious...

Fiber Security Breach

Fiber is an open source web framework written in the Go language. A security vulnerability exists in Fiber that stems from the presence of a cross-site request forgery CSRF vulnerability. The vulnerability can be exploited by an attacker to inject arbitrary values instead of the user and forge...

GO-2023-2052 IsFromLocal local address check can be circumvented in github.com/gofiber/fiber/v2

The Ctx.IsFromLocal function can incorrectly report a request as being sent from localhost when the request contains an X-Forwarded-For header containing a localhost IP address...

CVE-2023-41338

Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could...

CVE-2023-41338

The CVE-2023-41338 issue affects gofiber (Fiber) prior to v2.49.2 where ctx.IsFromLocal() may return true for requests with X-Forwarded-For: 127.0.0.1, allowing access to localhost-scoped resources. Root cause: improper handling of the X-Forwarded-For header in the Ctx.IsFromLocal logic, enabling...

CVE-2023-41338 Vulnerability in Ctx.IsFromLocal() in gofiber

Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could...

Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`

Impact This vulnerability can be categorized as a security misconfiguration. It impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. In it's...

Fiber Security Breach

Fiber is an open source web framework written in the Go language. A security vulnerability exists in Fiber versions prior to 2.49.1 that stems from not properly restricting access to localhost, which could allow an unauthorized attacker to access resources supplied to the localhost only...

VulnCheck KEV: CVE-2022-40005

Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 and /boaform/formTracert URIs for ping and traceroute...

Tenda G103 命令注入漏洞

Tenda G103 is a GPON fiber optic access device designed for home and SOHO users from Tenda, China. The Tenda G103 version 1.0.0.5 suffers from a command injection vulnerability that stems from the application's failure to properly filter constructed command special characters, commands, etc. An...