GitHub Advisoryadvisory · Go

GHSA-5x84-q523-vvwr nosurf vulnerable to improper input validation

HIGH Published 2022-12-28 Modified 2023-01-10 Official page ↗
Aliases
CVE-2020-36564
Ecosystem
Go
Packages
github.com/justinas/nosurf
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2022-12-30

Affected packages

• Go github.com/justinas/nosurf: < 1.1.1 → fixed in 1.1.1

Description

Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.

Related

Alias · CVE (1)

  • CVE-2020-36564 Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References