PT-2020-19789
CVE-2020-7780
·
تاريخ النشر
2020-11-27
·
تاريخ التحديث
2022-02-09
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
com.softwaremill.akka-http-session:core 2.13 versions prior to 0.5.11
com.softwaremill.akka-http-session:core 2.12 versions prior to 0.5.11
com.softwaremill.akka-http-session:core 2.11 versions prior to 0.5.11
Description
The issue affects older versions of the com.softwaremill.akka-http-session package, where endpoints protected by
randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.Recommendations
For com.softwaremill.akka-http-session:core 2.13 versions prior to 0.5.11, update to version 0.5.11 or later.
For com.softwaremill.akka-http-session:core 2.12 versions prior to 0.5.11, update to version 0.5.11 or later.
For com.softwaremill.akka-http-session:core 2.11 versions prior to 0.5.11, update to version 0.5.11 or later.
As a temporary workaround, consider disabling the
randomTokenCsrfProtection feature until a patch is available. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾