GitHub Advisoryadvisory · npm

GHSA-pj2c-h76w-vv6f tiny-csrf has openly visible CSRF tokens

HIGH Published 2022-10-07 Modified 2022-10-07 Official page ↗

Aliases: CVE-2022-39287
Ecosystem: npm
Packages: tiny-csrf
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses: CWE-319
Reviewed: 2022-10-07

Affected packages

• npm tiny-csrf: < 1.1.0 → fixed in 1.1.0

Description

Impact Weak encryption on CSRF so tokens can be read by malicious attackers. Patches Problems have been patched as of v1.1.0 Workarounds Upgrade to v1.1.0 References https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html For more information Submit an issue at the github repo

Related

Alias · CVE (1)

CVE-2022-39287 tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. vulnerability

Weakness · CWE (1)

CWE-319 Cleartext Transmission of Sensitive Information weakness

References