PT-2019-15937
CVE-2019-19737
·
تاريخ النشر
2019-12-30
·
تاريخ التحديث
2020-01-07
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
MFScripts YetiShare versions 3.5.2 through 4.5.3
Description
The issue allows session cookies to be sent in cross-site requests due to the missing SameSite flag, potentially leading to cross-site request forgery attacks.
Recommendations
For versions 3.5.2 through 4.5.3, consider setting the SameSite flag on session cookies to prevent them from being sent in cross-site requests as a mitigation measure. At the moment, there is no information about a newer version that contains a fix for this issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾