Cross-site Request Forgery (CSRF)

2023-01-1202:18:28

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github.com/go-macaron/csrf

cross-site request forgery

csrf cookie

insecure handling

EPSS

0.001

Percentile

41.7%

JSON

github.com/go-macaron/csrf is vulnerable to Cross-site Request Forgery (CSRF). The vulnerability exists because the Generate function in csrf.go does not set the secure mode for the CSRF cookie as the value is hardcoded to false for the corresponding arguments of SetCookie(), allowing an attacker to bypass CSRF protection through the CSRF cookie.