CVE-2022-39287

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-39287

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39287.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-39287

Aliases

GHSA-pj2c-h76w-vv6f

Published

2022-10-07T00:00:00Z

Modified

2026-07-15T01:49:09.483163745Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Plaintext transmission of CSRF tokens in tiny-csrf

Details

tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit 8eead6d and the patch with be included in version 1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "1.1.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-319"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39287.json"
}

References

Affected packages

Git / github.com/valexandersaulys/tiny-csrf

Affected ranges

Type

GIT

Repo

https://github.com/valexandersaulys/tiny-csrf

Events

Introduced

Fixed

8eead6da3b56e290512bbe8d20c2c5df3be317ba

Database specific

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39287.json"