PT-2018-4114 · Unknown · Csrf Magic

Sparticvs · Publicado 2018-08-08 · Atualizado 2018-10-09 · CVE-2013-7464

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions csrf-magic versions prior to 1.0.4

Description The issue allows an attacker to bypass CSRF protections due to a predictable Anti-CSRF Token. This predictability occurs when the $GLOBALS['csrf']['secret'] is not configured, resulting in the lack of use of an automatically generated secret.

Recommendations For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider configuring the $GLOBALS['csrf']['secret'] to prevent the use of a predictable token.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2013-7464

Produtos afetados

Csrf Magic

Referências · 4

• http://csrf.htmlpurifier.org/news/2013/0717-1.0.4-released · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-7464 · Nota de Segurança
• http://repo.or.cz/csrf-magic.git/blob/HEAD:/NEWS.txt · Nota
• http://repo.or.cz/csrf-magic.git/commit/9d2537f70d58b16aeba89779aaf1573b8d618e11 · Correção