GHSA-VPW5-GRXX-V396中危已审查

CSRF token exposure in TYPO3 extension

OSV 1.4.0 · github-reviewed · 修改于 2022-07-14 02:55

发布时间

2021-09-03 01:16

GitHub 审查时间

2021-08-31 01:23

NVD 发布时间

2021-08-14 01:15

源文件

advisories/github-reviewed/2021/09/GHSA-vpw5-grxx-v396/GHSA-vpw5-grxx-v396.json

公告说明

When using the CsrfTokenViewHelper the extension discloses the user's session identifier to HTML output without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance Cross Site Scripting in the frontend output.

受影响的软件包

Packagist

lms/routes

ECOSYSTEM

引入0修复2.1.1

标识信息

别名 / CVE

CVE-2021-36793

CWE

CWE-668

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C

原始 OSV JSON

{
  "id": "GHSA-vpw5-grxx-v396",
  "aliases": [
    "CVE-2021-36793"
  ],
  "details": "When using the CsrfTokenViewHelper the extension discloses the user's session identifier to HTML output without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance Cross Site Scripting  in the frontend output.",
  "summary": "CSRF token exposure in TYPO3 extension",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.1"
            }
          ]
        }
      ],
      "package": {
        "name": "lms/routes",
        "ecosystem": "Packagist"
      }
    }
  ],
  "modified": "2022-07-13T18:55:15Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C"
    }
  ],
  "published": "2021-09-02T17:16:56Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36793",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/Lacr1ma/routes",
      "type": "PACKAGE"
    },
    {
      "url": "https://typo3.org/security/advisory/typo3-ext-sa-2021-008",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2021-08-13T17:15:00Z",
    "github_reviewed_at": "2021-08-30T17:23:15Z"
  }
}