PT-2024-40138 · Sensiolabs · Sensiolabs/Connect

Published 2024-05-21 · Updated 2024-05-21

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: sensiolabs/connect versions prior to 4.2.3

Description: The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability. It occurs due to the absence of the state parameter in OAuth requests, which exposes applications to CSRF attacks during the OAuth authentication flow.

Recommendations: For versions prior to 4.2.3, update to version 4.2.3 or later to resolve the issue. As a temporary workaround, consider implementing proper state parameter handling in OAuth requests to prevent CSRF attacks.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

GHSA-6WQP-7G94-F69J

Affected Products

Sensiolabs/Connect

References · 5

• https://osv.dev/vulnerability/GHSA-6wqp-7g94-f69j · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/sensiolabs/connect/2018-06-08-1.yaml · Note
• https://github.com/symfonycorp/connect/commit/9522aa774e8a0f8a61e709d828e6cc34c4c1e703 · Note
• https://github.com/symfonycorp/connect · Note
• https://github.com/sensiolabs/connect/pull/63 · Note