CVE-2022-39287

Name of the Vulnerable Software and Affected Versions tiny-csrf versions prior to 1.1.0

Description The issue concerns the transmission of CSRF tokens in the clear due to unencrypted cookies in versions prior to 1.1.0. This allows malicious attackers to read the tokens. The problem has been addressed, and users are advised to upgrade to version 1.1.0.

Recommendations For versions prior to 1.1.0, upgrade to version 1.1.0 to resolve the issue. As a temporary workaround, consider disabling the use of CSRF tokens until the patch is applied. Restrict access to sensitive operations that rely on CSRF protection to minimize the risk of exploitation.