CVE-2022-39287highCWE-319

CVE-2022-39287: fallo de gravedad alta en valexandersaulys tiny-csrf

Plaintext transmission of CSRF tokens in tiny-csrf

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear tiny-csrf+ Monitorear tiny-csrf

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.1epss 0.5%
tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit `8eead6d` and the patch with be included in version 1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Productos afectados
valexandersaulys · tiny-csrf