valexandersaulys/tiny-csrf · Security
tiny-csrf has openly visible CSRF tokens
- GHSA ID
- GHSA-pj2c-h76w-vv6f
- CVE ID
- CVE-2022-39287
- Severity
- high
- Published
- Updated
- CVSS
- 8.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- CVSS v3
- 8.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Description
Impact
Weak encryption on CSRF so tokens can be read by malicious attackers.
Patches
Problems have been patched as of v1.1.0
Workarounds
Upgrade to v1.1.0
References
For more information
Submit an issue at the github repo
CWEs
- CWE-319 · Cleartext Transmission of Sensitive Information