CVE-2022-39287
Assigner: GitHub_M
Published: 2022-10-07T00:00:00
State: PUBLISHED
title: Plaintext transmission of CSRF tokens in tiny-csrf
descriptions: value: tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit `8eead6d` and the patch with be included in version 1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.
affected: vendor: valexandersaulys
product: tiny-csrf
versions: version: < 1.1.0
status: affected
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-319: Cleartext Transmission of Sensitive Information
cweId: CWE-319
source: advisory: GHSA-pj2c-h76w-vv6f
discovery: UNKNOWN