GitHub Advisoryadvisory · npm

GHSA-wf5p-g6vw-rhxx Axios Cross-Site Request Forgery Vulnerability

MEDIUM Published 2023-11-08 Modified 2024-06-21 Official page ↗
Aliases
CVE-2023-45857
Ecosystem
npm
Packages
axios
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-352
Reviewed
2023-11-10

Affected packages

• npm axios: >= 1.0.0, < 1.6.0 → fixed in 1.6.0 • npm axios: >= 0.8.1, < 0.28.0 → fixed in 0.28.0

Description

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Related

Alias · CVE (1)

  • CVE-2023-45857 An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References