Описание
Golf may allow attacker to bypass CSRF protections due to weak PRNG
CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests.
Пакеты
Наименование
github.com/dinever/golf
go
Затронутые версииВерсия исправления
< 0.3.0
0.3.0
Связанные уязвимости
CVSS3: 8.8
nvd
около 3 лет назад
CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests.