Go/github.com/go-macaron/csrf CVE-2018-25060: high 7.5, EPSS 0.54%

Macaron csrf missing encryption and has sensitive cookies in HTTP session without secure attribute

Action: Upgrade github.com/go-macaron/csrf to 0.0.0-20180426211050-dadd1711a617 or later.

go get github.com/go-macaron/csrf@v0.0.0-20180426211050-dadd1711a617

Affected

Fixed versions

Sources

• osv: GHSA-hhxg-px5h-jc32
• https://nvd.nist.gov/vuln/detail/CVE-2018-25060
• https://github.com/go-macaron/csrf/pull/7
• https://github.com/go-macaron/csrf/commit/dadd1711a617000b70e5e408a76531b73187031c
• https://github.com/go-macaron/csrf
• https://pkg.go.dev/vuln/GO-2022-1213
• https://vuldb.com/?ctiid.217058
• https://vuldb.com/?id.217058

CVE-2018-25060 · published 2022-12-30T12:30:25Z · modified 2024-03-01T14:24:38Z · JSON