GHSA-pj2c-h76w-vv6fHighCVSS 8.1

tiny-csrf has openly visible CSRF tokens

Published
October 7, 2022
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2022-39287 →

📋 Description

Impact

Weak encryption on CSRF so tokens can be read by malicious attackers.

Patches

Problems have been patched as of v1.1.0

Workarounds

Upgrade to v1.1.0

References

https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html

For more information

Submit an issue at the github repo

🎯 Affected products1

  • npm/tiny-csrf:< 1.1.0

🔗 References (4)