GHSA-4rm3-4mq4-mfwr

Cross-Site Request Forgery (CSRF) in hswebframework.web:hsweb-commons

Source: GitHub Advisory Database (reviewed) High CVE-2018-20595

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.hswebframework.web:hsweb-commons	<= 3.0.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-20595 advisory
https://github.com/hs-web/hsweb-framework/issues/107 web
https://github.com/hs-web/hsweb-framework/commit/40929e9b0d336a26281a5ed2e0e721d54dd8d2f2 web
https://github.com/advisories/GHSA-4rm3-4mq4-mfwr advisory
https://github.com/hs-web/hsweb-framework package