~ / search / GHSA-q42q-523g-3fwv

GHSA-q42q-523g-3fwv

Cross-Site Request Forgery

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-7780

Packages

EcosystemPackageAffectedFixed in
Maven com.softwaremill.akka-http-session:core_2.13 < 0.5.11 0.5.11
Maven com.softwaremill.akka-http-session:core_2.12 < 0.5.11 0.5.11
Maven com.softwaremill.akka-http-session:core_2.11 < 0.5.11 0.5.11

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.

References

External links from the advisory. They lead to third-party sites.