GitHub Advisoryadvisory · Packagist

GHSA-6wqp-7g94-f69j sensiolabs/connect has a Cross-Site Request Forgery Vulnerability

MEDIUM Published 2024-05-21 Modified 2024-05-21 Official page ↗
Ecosystem
Packagist
Packages
sensiolabs/connect
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-352
Reviewed
2024-05-21

Affected packages

• Packagist sensiolabs/connect: < 4.2.3 → fixed in 4.2.3

Description

Versions of sensiolabs/connect prior to 4.2.3 are affected by a Cross-Site Request Forgery (CSRF) vulnerability due to the absence of the state parameter in OAuth requests. The lack of proper state parameter handling exposes applications to CSRF attacks during the OAuth authentication flow.

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References