CVE-2022-39287

Plaintext transmission of CSRF tokens in tiny-csrf

CVSS 8.1 HIGHEPSS 0.4%CWE-319

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.1EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

07 Oct 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit `8eead6d` and the patch with be included in version 1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products

valexandersaulys · tiny-csrf

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/valexandersaulys/tiny-csrf/commit/8eead6da3b56e290512bbe8d20c2c5df3be317ba https://github.com/valexandersaulys/tiny-csrf/security/advisories/GHSA-pj2c-h76w-vv6f