Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1wajJjLWg3NnctdnY2Zs4AAvNW

tiny-csrf has openly visible CSRF tokens

Impact

Weak encryption on CSRF so tokens can be read by malicious attackers.

Patches

Problems have been patched as of v1.1.0

Workarounds

Upgrade to v1.1.0

References

https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html

For more information

Submit an issue at the github repo

Permalink: https://github.com/advisories/GHSA-pj2c-h76w-vv6f
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wajJjLWg3NnctdnY2Zs4AAvNW
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: almost 2 years ago

CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS Percentage: 0.00122
EPSS Percentile: 0.47114

Identifiers: GHSA-pj2c-h76w-vv6f, CVE-2022-39287
References:

• https://github.com/valexandersaulys/tiny-csrf/security/advisories/GHSA-pj2c-h76w-vv6f
• https://github.com/valexandersaulys/tiny-csrf/commit/8eead6da3b56e290512bbe8d20c2c5df3be317ba
• https://nvd.nist.gov/vuln/detail/CVE-2022-39287
• https://github.com/advisories/GHSA-pj2c-h76w-vv6f

Repository: https://github.com/valexandersaulys/tiny-csrf
Blast Radius: 14.8

Affected Packages