high8.1
CVE-2022-39287
tiny-csrf has openly visible CSRF tokens
Impact
### Impact Weak encryption on CSRF so tokens can be read by malicious attackers. ### Patches Problems have been patched as of v1.1.0 ### Workarounds Upgrade to v1.1.0 ### References https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html ### For more information Submit an issue at [the github repo](https://github.com/valexandersaulys/tiny-csrf)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | tiny-csrf | < 1.1.0 | 1.1.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tiny-Csrf Project | Tiny-Csrf | before 1.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/valexandersaulys/tiny-csrf/commit/8eead6da3b56e290512bbe8d20c2c5df3be317ba
- https://github.com/valexandersaulys/tiny-csrf/security/advisories/GHSA-pj2c-h76w-vv6f
- https://github.com/advisories/GHSA-pj2c-h76w-vv6f
- https://nvd.nist.gov/vuln/detail/CVE-2022-39287