PT-2018-15459
CVE-2018-20595
·
تاريخ النشر
2018-12-30
·
تاريخ التحديث
2019-01-14
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
hsweb version 3.0.4
Description
A CSRF issue was discovered because the
state parameter in the request is not compared with the state parameter in the session after user authentication is successful.Recommendations
For hsweb version 3.0.4, consider modifying the OAuth2ClientController.java to compare the
state parameter in the request with the state parameter in the session after user authentication is successful to prevent CSRF attacks. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾