PT-2024-14587 · Unknown · Plack::Middleware::Xsrfblock

Published 2024-02-12 · Updated 2024-10-21 · CVE-2023-52431

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Plack::Middleware::XSRFBlock versions prior to 0.0.19

Description The issue allows attackers to bypass a CSRF protection mechanism via an empty form value and an empty cookie, but only if signed cookies are disabled.

Recommendations For versions prior to 0.0.19, update to version 0.0.19 or later to resolve the issue. As a temporary workaround, consider enabling signed cookies to minimize the risk of exploitation.

Fix

Improper Privilege Management

CSRF

Weakness Enumeration

CWE-269

CWE-352

Related Identifiers

CVE-2023-52431

Affected Products

Plack::Middleware::Xsrfblock

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-52431 · Security Note
• https://osv.dev/vulnerability/CVE-2023-52431 · Vendor Advisory
• https://github.com/briandfoy/cpan-security-advisory/blob/9374f98bef51e1ae887f293234050551c079776f/cpansa/CPANSA-Plack-Middleware-XSRFBlock.yml#L2-L15 · Note
• https://t.me/cvenotify/99020 · Telegram Post
• https://metacpan.org/release/DAKKAR/Plack-Middleware-XSRFBlock-0.0.19/source/Changes · Note
• https://t.me/cvenotify/88291 · Telegram Post
• https://twitter.com/CVEnew/status/1757272256101953544 · Twitter Post
• https://twitter.com/Esparta6108713/status/1757274643185143910 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1757293415216095675 · Twitter Post
• https://t.me/cvenotify/71188 · Telegram Post