PT-2022-8070 · Unknown+1 · Macaron Csrf+1

Published 2022-12-30 · Updated 2024-05-17 · CVE-2018-25060

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Macaron csrf (affected versions not specified)

Description A vulnerability was found in Macaron csrf, classified as problematic. It affects some unknown functionality of the file csrf.go. The manipulation of the argument Generate leads to sensitive cookies without the secure attribute. The attack may be launched remotely. The complexity of an attack is rather high, and the exploitation is known to be difficult.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

CWE-614

Related Identifiers

CVE-2018-25060

GHSA-HHXG-PX5H-JC32

GO-2022-1213

Affected Products

Debian

Macaron Csrf

References · 17

• https://github.com/go-macaron/csrf/commit/dadd1711a617000b70e5e408a76531b73187031c · Patch
• https://github.com/go-macaron/csrf/pull/7 · Patch
• https://osv.dev/vulnerability/GHSA-hhxg-px5h-jc32 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-25060 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-25060 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-25060 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-25060 · Security Note
• https://ubuntu.com/security/CVE-2018-25060 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-25060 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-25060 · Security Note
• https://osv.dev/vulnerability/GO-2022-1213 · Vendor Advisory
• https://github.com/go-macaron/csrf · Note
• https://pkg.go.dev/vuln/GO-2022-1213 · Note
• https://t.me/cibsecurity/55560 · Telegram Post
• https://vuldb.com/?id.217058 · Note