GHSA-6wqp-7g94-f69j
Suggest an improvement- Source
- https://github.com/advisories/GHSA-6wqp-7g94-f69j
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-6wqp-7g94-f69j/GHSA-6wqp-7g94-f69j.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-6wqp-7g94-f69j
- Published
- 2024-05-21T18:26:46Z
- Modified
- 2024-12-06T05:40:48.192659Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- sensiolabs/connect has a Cross-Site Request Forgery Vulnerability
- Details
-
Versions of sensiolabs/connect prior to 4.2.3 are affected by a Cross-Site Request Forgery (CSRF) vulnerability due to the absence of the state parameter in OAuth requests. The lack of proper state parameter handling exposes applications to CSRF attacks during the OAuth authentication flow.
- Database specific
{ "nvd_published_at": null, "cwe_ids": [ "CWE-352" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-05-21T18:26:46Z" }- References
Affected packages
Packagist / sensiolabs/connect
Package
- Name
- sensiolabs/connect
- Purl
- pkg:composer/sensiolabs/connect