PT-2018-15459 · Hsweb · Hsweb

Published 2018-12-30 · Updated 2019-01-14 · CVE-2018-20595

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions hsweb version 3.0.4

Description A CSRF issue was discovered because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful.

Recommendations For hsweb version 3.0.4, consider modifying the OAuth2ClientController.java to compare the state parameter in the request with the state parameter in the session after user authentication is successful to prevent CSRF attacks.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-20595

GHSA-4RM3-4MQ4-MFWR

Affected Products

Hsweb

References · 7

• 🔥 https://github.com/hs-web/hsweb-framework/issues/107 · Exploit
• https://github.com/hs-web/hsweb-framework/commit/40929e9b0d336a26281a5ed2e0e721d54dd8d2f2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-20595 · Security Note
• https://osv.dev/vulnerability/GHSA-4rm3-4mq4-mfwr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-20595 · Vendor Advisory
• https://github.com/hs-web/hsweb-framework · Note
• https://github.com/advisories/GHSA-4rm3-4mq4-mfwr · Note