CVE-2020-28482

Katalog CVE

CVSS 8.8 · High EPSS 0,98%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada fastify-csrf. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true } 2. The CSRF token was available in the GET query parameter

Rincian

Terbit di NVD

19 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,98% peluang dieksploitasi; lebih tinggi dari 61,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/fastify/fastify-csrf/pull/26 advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-FASTIFYCSRF-1062044 advisory pihak ketiga