PT-2018-4114 · Unknown · Csrf Magic

Sparticvs · Published 2018-08-08 · Updated 2018-10-09 · CVE-2013-7464

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions csrf-magic versions prior to 1.0.4

Description The issue allows an attacker to bypass CSRF protections due to a predictable Anti-CSRF Token. This predictability occurs when the $GLOBALS['csrf']['secret'] is not configured, resulting in the lack of use of an automatically generated secret.

Recommendations For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider configuring the $GLOBALS['csrf']['secret'] to prevent the use of a predictable token.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2013-7464

Affected Products

Csrf Magic

References · 4

• http://csrf.htmlpurifier.org/news/2013/0717-1.0.4-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7464 · Security Note
• http://repo.or.cz/csrf-magic.git/commit/9d2537f70d58b16aeba89779aaf1573b8d618e11 · Patch
• http://repo.or.cz/csrf-magic.git/blob/HEAD:/NEWS.txt · Note