PT-2021-12079 · Github.Com/Justinas/Nosurf+3 · Github.Com/Justinas/Nosurf+1

Aeneasr · Published 2021-04-14 · Updated 2025-04-11 · CVE-2020-36564

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions.

Description: The issue arises due to improper validation of caller input. If the provided expected token is malformed, validation is silently disabled, causing any user-supplied token to be considered valid. This could potentially allow unauthorized access.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-36564

GHSA-5X84-Q523-VVWR

GO-2020-0049

Affected Products

Github.Com/Justinas/Nosurf

Nosurf

References · 11

• https://github.com/justinas/nosurf/pull/60 · Patch
• https://github.com/justinas/nosurf/commit/4d86df7a4affa1fa50ab39fb09aac56c3ce9c314 · Patch
• https://osv.dev/vulnerability/GHSA-5x84-q523-vvwr · Vendor Advisory
• https://osv.dev/vulnerability/GO-2020-0049 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36564 · Security Note
• https://github.com/justinas/nosurf · Note
• https://t.me/cibsecurity/55445 · Telegram Post
• https://pkg.go.dev/vuln/GO-2020-0049 · Note
• https://t.me/cvenotify/40832 · Telegram Post
• https://t.me/cvenotify/118919 · Telegram Post