CVE-2018-12540: CSRF
Published Jul 12, 2018
·Updated
In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet.
Affected Software
3 affected componentsFixes available
redhat/vertex-web<3.5.3
3.5.3
maven/io.vertx:vertx-web>=3.0.0<3.5.3
3.5.3
Eclipse Vert.x>=3.0.0<=3.5.2
Event History
Jul 12, 2018
CVE Published
12:00 AM
Data Sourced
12:00 AM
RemedyDescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionWeakness
Oct 17, 2018
Advisory Published
via GitHub·04:19 PM
Frequently Asked Questions
1
What is the severity of CVE-2018-12540?
CVE-2018-12540 is rated as a medium severity vulnerability due to its potential for replay attacks.
2
How do I fix CVE-2018-12540?
To fix CVE-2018-12540, upgrade Eclipse Vert.x to version 3.5.3 or later.
3
What versions of Eclipse Vert.x are affected by CVE-2018-12540?
Versions of Eclipse Vert.x from 3.0.0 to 3.5.2 are affected by CVE-2018-12540.
4
What type of attacks does CVE-2018-12540 allow?
CVE-2018-12540 allows replay attacks with previously issued tokens that are not expired.
5
Is the CSRFHandler secure in versions after CVE-2018-12540?
Yes, the CSRFHandler is secure in versions after 3.5.2 as it addresses the vulnerability.