GHSA-h9wq-xcqx-mqxm

Source

https://github.com/advisories/GHSA-h9wq-xcqx-mqxm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-h9wq-xcqx-mqxm/GHSA-h9wq-xcqx-mqxm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h9wq-xcqx-mqxm

Published

2023-07-11T22:46:19Z

Modified

2023-07-11T22:46:19Z

Summary

Vendure Cross Site Request Forgery vulnerability impacting all API requests

Details

Impact

Vendure is an e-commerce GraphQL framework with a number of APIs and different levels of authorization. By default the Cookie settings are insecure, having the SameSite setting as false which results in not having one (originates from the cookie-session npm package’s default settings).

Patches

In progress

Workarounds

Manually set the authOptions.cookieOptions.sameSite configuration option to 'strict', 'lax' or true.

References

Are there any links users can visit to find out more?

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-07-11T22:46:19Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

npm / @vendure/core

Package

Name: @vendure/core; View open source insights on deps.dev
Purl: pkg:npm/%40vendure/core

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.0.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-h9wq-xcqx-mqxm/GHSA-h9wq-xcqx-mqxm.json"