CVE-2020-7780GHSA-Q42Q-523G-3FWV
Cross-site Request Forgery (CSRF)
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.5.11
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a com.softwaremill.akka-http-session:core_2.13
fixed in 0.5.11
- n/a com.softwaremill.akka-http-session:core_2.12
fixed in 0.5.11
- n/a com.softwaremill.akka-http-session:core_2.11
fixed in 0.5.11
- com.softwaremill.akka-http-session:core_2.13Maven
fixed in 0.5.11
- com.softwaremill.akka-http-session:core_2.12Maven
fixed in 0.5.11
- com.softwaremill.akka-http-session:core_2.11Maven
fixed in 0.5.11