PT-2018-15459

CVE-2018-20595

·

Published

2018-12-30

·

Updated

2019-01-14

Description by

CVSS 3.1
8.8
High
MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions hsweb version 3.0.4
Description A CSRF issue was discovered because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful.
Recommendations For hsweb version 3.0.4, consider modifying the OAuth2ClientController.java to compare the state parameter in the request with the state parameter in the session after user authentication is successful to prevent CSRF attacks.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-352: Cross-Site Request Forgery (CSRF)
Related identifiers
CVE-2018-20595
GHSA-4RM3-4MQ4-MFWR
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com