GHSA-rvgg-f8qm-6h7j

Suggest an improvement
Source
https://github.com/advisories/GHSA-rvgg-f8qm-6h7j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-rvgg-f8qm-6h7j/GHSA-rvgg-f8qm-6h7j.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-rvgg-f8qm-6h7j
Aliases
Published
2018-10-17T16:19:43Z
Modified
2024-12-03T06:00:55Z
Summary
High severity vulnerability that affects io.vertx:vertx-web
Details

In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet.

Database specific 
{
    "cwe_ids":  [
        "CWE-352"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T21:55:57Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

Maven / io.vertx:vertx-web

Package

Name
io.vertx:vertx-web
View open source insights on deps.dev
Purl
pkg:maven/io.vertx/vertx-web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.5.3

Affected versions

3.*
3.0.0
3.1.0
3.2.0
3.2.1
3.3.0.CR1
3.3.0.CR2
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0.Beta1
3.4.0
3.4.1
3.4.2
3.5.0.Beta1
3.5.0
3.5.1
3.5.2.CR1
3.5.2.CR2
3.5.2.CR3
3.5.2
3.5.3.CR1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-rvgg-f8qm-6h7j/GHSA-rvgg-f8qm-6h7j.json"