CVE-2020-7780
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2020-7780
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7780.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2020-7780
- Aliases
- Related
- Published
- 2020-11-27T17:15:12Z
- Modified
- 2025-01-15T01:46:39.768110Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
This affects the package com.softwaremill.akka-http-session:core2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.
- References
-
- https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1045352
- https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1046654
- https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1046655
- https://github.com/softwaremill/akka-http-session/commit/57f11663eecb84be03383d164f655b9c5f953b41
- https://github.com/softwaremill/akka-http-session/issues/74
- https://github.com/softwaremill/akka-http-session/issues/77
Affected packages
Git / github.com/softwaremill/akka-http-session
Affected ranges
- Type
- GIT
- Repo
- https://github.com/softwaremill/akka-http-session
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
Affected versions
release-0.*
release-0.1
release-0.1.2
release-0.1.3
release-0.1.4
release-0.1.4-2.0-M1
release-0.2.0
release-0.2.1
release-0.2.2
release-0.2.3
release-0.2.4
release-0.2.6
release-0.2.7
release-0.3.0
release-0.4.0
release-0.5.0
release-0.5.2
release-0.5.4
release-1.*
release-1.1
v0.*
v0.5.10
v0.5.5
v0.5.6
v0.5.7
v0.5.8
v0.5.9