CVE-2018-12540CWE-352

In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter

published July 12, 2018

CVSS
—
EPSS
2%
Percentile
80.5
In the wild
Unconfirmed
What it is

In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01994 · 80.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2018-07-12T14:00Z
EPSS history
Timeline
  • 12 JUL 14:00Z
    In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter
    cvelistv5