GHSA-q42q-523g-3fwvMediumCVSS 8.8

Cross-Site Request Forgery

Published
February 9, 2022
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-7780 →

📋 Description

This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.

🎯 Affected products3

  • maven/com.softwaremill.akka-http-session:core_2.13:< 0.5.11
  • maven/com.softwaremill.akka-http-session:core_2.12:< 0.5.11
  • maven/com.softwaremill.akka-http-session:core_2.11:< 0.5.11

🔗 References (8)