Описание
A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful.
Ссылки
- PatchThird Party Advisory
- ExploitIssue TrackingThird Party Advisory
- PatchThird Party Advisory
- ExploitIssue TrackingThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:hsweb:hsweb:3.0.4:*:*:*:*:*:*:*
EPSS
Процентиль: 24%
0.00081
Низкий
8.8 High
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-352
Связанные уязвимости
CVSS3: 8.8
github
около 7 лет назад
Cross-Site Request Forgery (CSRF) in hswebframework.web:hsweb-commons
EPSS
Процентиль: 24%
0.00081
Низкий
8.8 High
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-352