Cross-site Request Forgery (CSRF)

2022-10-1114:13:42

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site request forgery

csrf vulnerability

cookie encryption

token access

0.001 Low

EPSS

Percentile

48.8%

JSON

tiny-csrf is vulnerable to cross-site request forgery. The vulnerability exists due tocsurf because the cookies are not encrypted which allows an attacker to gain access to the tokens and bypass CSRF checks.

CPENameOperatorVersion
tiny-csrfle1.0.3
tiny-csrfle1.0.3

CPE	Name	Operator	Version
	tiny-csrf	le	1.0.3
	tiny-csrf	le	1.0.3

References

github.com/advisories/GHSA-pj2c-h76w-vv6f

github.com/valexandersaulys/tiny-csrf/commit/8eead6da3b56e290512bbe8d20c2c5df3be317ba

github.com/valexandersaulys/tiny-csrf/security/advisories/GHSA-pj2c-h76w-vv6f

0.001 Low

EPSS

Percentile

48.8%

JSON

Related for VERACODE:37512