Improper input validation in github.com/justinas/nosurf
CVE-2020-36564

7.5HIGH

Key Information:

Vendor: Github.com/justinas/nosurf
Status: Github.com/justinas/nosurf
Vendor: CVE Published:; 27 December 2022

🔔 Create Github.com/justinas/nosurf Vulnerability Alert

What is CVE-2020-36564?

Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.

Affected Version(s)

github.com/justinas/nosurf 0 < 1.1.1

References

https://github.com/justinas/nosurf/pull/60

https://github.com/justinas/nosurf/commit/4d86df7a4affa1f...

https://pkg.go.dev/vuln/GO-2020-0049

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Dec 27, 2022
Vulnerability Reserved
Jul 29, 2022

Credit

@aeneasr