CVE-2020-36564

Improper input validation in github.com/justinas/nosurf

High · published December 27, 2022

CVSS v3.1
7.5
EPSS
1%
Percentile
54.6
In the wild
Unconfirmed
What it is

Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00755 · 54.6th percentile
Published
2022-12-27T21:13Z
EPSS history
Timeline
  • 27 DEC 21:13Z
    Improper input validation in github.com/justinas/nosurf
    cvelistv5