CVE-2022-39287CWE-319

Plaintext transmission of CSRF tokens in tiny-csrf

High · published October 7, 2022

CVSS v3.1

8.1

EPSS

Percentile

42.5

In the wild

Unconfirmed

What it is

tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit `8eead6d` and the patch with be included in version 1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00508 · 42.5th percentile
Weakness: CWE-319 · Cleartext Transmission of Sensitive Information
Published: 2022-10-07T00:00Z

EPSS history

Timeline

07 OCT 00:00Z
Plaintext transmission of CSRF tokens in tiny-csrf
cvelistv5