Cross-Site Request Forgery Vulnerability in Eclipse Vert.x Versions 3.0.0 to 3.5.2
CVE-2018-12540

8.8HIGH

Key Information:

Vendor: The Eclipse Foundation
Status: Eclipse Vert.x
Vendor: CVE Published:; 12 July 2018

🔔 Create The Eclipse Foundation Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-12540?

A vulnerability exists in Eclipse Vert.x versions 3.0.0 through 3.5.2, where the CSRFHandler does not properly verify the XSRF Cookie against the returned XSRF header or form parameter. This flaw enables attackers to reuse previously issued tokens that remain unexpired, potentially allowing for unauthorized actions to be performed on behalf of the user without their consent.

Affected Version(s)

Eclipse Vert.x 3.0

Eclipse Vert.x <= 3.5.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

vertx-web-xsrf
Created by bernard-wagner

CVE-2018-12540
Created by tafamace