CVE-2018-12540GHSA-RVGG-F8QM-6H7J
In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form p
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.5.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 2 proofs of concept on GitHub
Summary
In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet.
Timeline
- CVE published
- Record last updated
Affected versions
- The Eclipse Foundation Eclipse Vert.x
From 3.0; through 3.5.2
- io.vertx:vertx-webMaven
From 3.0.0 · fixed in 3.5.3
References 8
bugs.eclipse.org
access.redhat.com
lists.apache.org
- thread.html/r59482ebed302aa49ac7e0c51737499746b0d086fcdeb8f90e705951f@<commits.pulsar.apache.org>
- thread.html/r3fffda8e947edaa359152c8dc4c4ea9c96fd8ced1999bbce92bc6b25@<commits.pulsar.apache.org>
- thread.html/rc5b4ae8a7caae6d3d5b3266cb050823b96dd62b30718b90b778d3d8b@<commits.pulsar.apache.org>
- thread.html/r10aef585c521f8ef603f5831f9d97a27d920624025131da950e0c62f@<commits.pulsar.apache.org>