PT-2022-8303 · Unknown · Nsupdate.Info

Published 2022-12-27 · Updated 2024-05-17 · CVE-2019-25091

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions nsupdate.info (affected versions not specified)

Description A problematic vulnerability has been found in nsupdate.info, affecting the component CSRF Cookie Handler in the file src/nsupdate/settings/base.py. The manipulation of the argument CSRF COOKIE HTTPONLY leads to a cookie without the httponly flag. This issue can be initiated remotely.

Recommendations To fix this issue, it is recommended to apply a patch, specifically the one with the name 60a3fe559c453bc36b0ec3e5dd39c1303640a59a. As a temporary workaround, consider restricting the manipulation of the CSRF COOKIE HTTPONLY argument to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-1004

Related Identifiers

CVE-2019-25091

GHSA-MWVP-QR62-CVJX

Affected Products

Nsupdate.Info

References · 10

• https://github.com/nsupdate-info/nsupdate.info/commit/60a3fe559c453bc36b0ec3e5dd39c1303640a59a · Patch
• https://github.com/nsupdate-info/nsupdate.info/pull/410 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-25091 · Security Note
• https://osv.dev/vulnerability/GHSA-mwvp-qr62-cvjx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-25091 · Vendor Advisory
• https://github.com/nsupdate-info/nsupdate.info · Note
• https://vuldb.com/?id.216909 · Note
• https://vuldb.com/?ctiid.216909 · Note
• https://t.me/cvenotify/40847 · Telegram Post
• https://t.me/cvenotify/40883 · Telegram Post