GitHub Advisoryadvisory · Go

GHSA-q9qr-jwpw-3qvv Golf may allow attacker to bypass CSRF protections due to weak PRNG

HIGH Published 2022-12-28 Modified 2024-05-20 Official page ↗
Aliases
CVE-2016-15005
Ecosystem
Go
Packages
github.com/dinever/golf
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-332, CWE-352
Reviewed
2022-12-30

Affected packages

• Go github.com/dinever/golf: < 0.3.0 → fixed in 0.3.0

Description

CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests.

Related

Alias · CVE (1)

  • CVE-2016-15005 CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict… vulnerability

Weakness · CWE (2)

  • CWE-332 Insufficient Entropy in PRNG weakness
  • CWE-352 Cross-Site Request Forgery weakness

References