GitHub Advisoryadvisory · Go

GHSA-cjcc-46j8-xmr8 destiny.gg chat vulnerable to cross-site request forgery

HIGH Published 2022-12-22 Modified 2024-03-21 Official page ↗
Aliases
CVE-2020-36625
Ecosystem
Go
Packages
github.com/destinygg/chat
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352, CWE-863
Reviewed
2022-12-30

Affected packages

• Go github.com/destinygg/chat: <= 0.0.0-20220628124252-0981d5add8f3 (no fix yet)

Description

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Related

Alias · CVE (1)

  • CVE-2020-36625 A vulnerability was found in destiny.gg chat. vulnerability

Weakness · CWE (2)

  • CWE-352 Cross-Site Request Forgery weakness
  • CWE-863 Incorrect Authorization weakness

References