PT-2018-15459 · Hsweb · Hsweb

Publicado 2018-12-30 · Atualizado 2019-01-14 · CVE-2018-20595

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions hsweb version 3.0.4

Description A CSRF issue was discovered because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful.

Recommendations For hsweb version 3.0.4, consider modifying the OAuth2ClientController.java to compare the state parameter in the request with the state parameter in the session after user authentication is successful to prevent CSRF attacks.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-20595

GHSA-4RM3-4MQ4-MFWR

Produtos afetados

Hsweb

Referências · 7

• 🔥 https://github.com/hs-web/hsweb-framework/issues/107 · Exploit
• https://github.com/hs-web/hsweb-framework/commit/40929e9b0d336a26281a5ed2e0e721d54dd8d2f2 · Correção
• https://github.com/hs-web/hsweb-framework · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-20595 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-4rm3-4mq4-mfwr · Aviso do Fabricante
• https://github.com/advisories/GHSA-4rm3-4mq4-mfwr · Nota
• https://osv.dev/vulnerability/CVE-2018-20595 · Aviso do Fabricante