CVE-2020-7780

Name of the Vulnerable Software and Affected Versions com.softwaremill.akka-http-session:core 2.13 versions prior to 0.5.11 com.softwaremill.akka-http-session:core 2.12 versions prior to 0.5.11 com.softwaremill.akka-http-session:core 2.11 versions prior to 0.5.11

Description The issue affects older versions of the com.softwaremill.akka-http-session package, where endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.

Recommendations For com.softwaremill.akka-http-session:core 2.13 versions prior to 0.5.11, update to version 0.5.11 or later. For com.softwaremill.akka-http-session:core 2.12 versions prior to 0.5.11, update to version 0.5.11 or later. For com.softwaremill.akka-http-session:core 2.11 versions prior to 0.5.11, update to version 0.5.11 or later. As a temporary workaround, consider disabling the randomTokenCsrfProtection feature until a patch is available.