GHSA-GV7G-X59X-WF8F SvelteKit framework has Insufficient CSRF protection for CORS requests

Summary The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protection to its users. The protection is...

@brewer/beerui (>=1.1.9, <=1.1.17), @dirk-bester/dark-light (>=0.0.1, <=1.0.0) +18 more potentially affected by CVE-2023-29008 via @sveltejs/kit (>=1.0.0, <=1.13.0)

@sveltejs/kit NPM version =1.0.0, =1.1.9, =0.0.1, =4.6.2, =0.0.0-24593668, =4.3.8, =1.0.4, =1.0.0-next.8, =1.0.0-next.13, =0.0.20, =0.15.0-next.1, =0.19.0, =0.17.0-next.1, =0.18.0 and more Source cves: CVE-2023-29008 Source advisory: OSV:GHSA-GV7G-X59X-WF8F...

CVE-2023-29008

The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protection to its users. The protection is...

Cross site request forgery (csrf)

The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protection to its users. The protection is...

CVE-2023-29008 SvelteKit framework has Insufficient CSRF protection for CORS requests

The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protection to its users. The protection is...

CVE-2023-29008

CVE-2023-29008 (SvelteKit CSRF issue) is described across multiple sources as a CSRF protection bypass in versions prior to 1.15.2. The vulnerability arises because the internal CSRF check (respond.js) relies on a Content-Type comparison that can be bypassed when an upper-cased Content-Type heade...

CVE-2023-29008 SvelteKit framework has Insufficient CSRF protection for CORS requests

The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protection to its users. The protection is...

CVE-2023-29008 SvelteKit framework has Insufficient CSRF protection for CORS requests

The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protection to its users. The protection is...

PT-2023-22082 · Sveltekit · Sveltekit

Name of the Vulnerable Software and Affected Versions: SvelteKit versions prior to 1.15.2 Description: The SvelteKit framework provides out-of-the-box cross-site request forgery CSRF protection. However, this protection can be bypassed in versions prior to 1.15.2 by specifying an upper-cased...

CVE-2023-29003

SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protecti...

Cross site request forgery (csrf)

SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protecti...

SvelteKit vulnerable to Cross-Site Request Forgery

Summary The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protection to it’s users. The protection i...

GHSA-5P75-VC5G-8RV2 SvelteKit vulnerable to Cross-Site Request Forgery

Summary The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protection to it’s users. The protection i...

@brewer/beerui (>=1.1.9, <=1.1.17), @dirk-bester/dark-light (>=0.0.1, <=1.0.0) +18 more potentially affected by CVE-2023-29003 via @sveltejs/kit (>=1.0.0, <=1.13.0)

@sveltejs/kit NPM version =1.0.0, =1.1.9, =0.0.1, =4.6.2, =0.0.0-24593668, =4.3.8, =1.0.4, =1.0.0-next.8, =1.0.0-next.13, =0.0.20, =0.15.0-next.1, =0.19.0, =0.17.0-next.1, =0.18.0 and more Source cves: CVE-2023-29003 Source advisory: OSV:GHSA-5P75-VC5G-8RV2...

CVE-2023-29003 SvelteKit has Insufficient Cross-Site Request Forgery Protection

SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protecti...

CVE-2023-29003 SvelteKit has Insufficient Cross-Site Request Forgery Protection

SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protecti...

CVE-2023-29003 SvelteKit has Insufficient Cross-Site Request Forgery Protection

SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protecti...

CVE-2023-29003

CVE-2023-29003 affects SvelteKit CSRF protection. Prior to version 1.15.1, an attacker could bypass CSRF by sending requests with a crafted Content-Type header, enabling cross-site requests from third parties and potentially session takeover. SvelteKit 1.15.1 hardens CSRF by (1) treating text/pla...

PT-2023-22079 · Sveltekit · Sveltekit

Name of the Vulnerable Software and Affected Versions: SvelteKit versions prior to 1.15.1 Description: The SvelteKit framework provides out-of-the-box cross-site request forgery CSRF protection. However, prior to version 1.15.1, this protection can be bypassed by specifying a different Content-Ty...