CVE-2020-28482: Cross-site Request Forgery (CSRF)
Published Jan 19, 2021
·Updated
This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true } 2. The CSRF token was available in the GET query parameter
Affected Software
1 affected component
fastify Fastify-csrf Node.js<3.0.0
Event History
Jan 19, 2021
CVE Published
via MITRE·02:50 PM
Data Sourced
via MITRE·02:50 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-28482?
CVE-2020-28482 is classified as a Medium severity vulnerability.
2
How do I fix CVE-2020-28482?
To fix CVE-2020-28482, upgrade the fastify-csrf package to version 3.0.0 or later.
3
What are the implications of CVE-2020-28482?
CVE-2020-28482 can lead to CSRF attacks due to the insecure cookie settings and token exposure.
4
Which versions of fastify-csrf are affected by CVE-2020-28482?
CVE-2020-28482 affects all versions of fastify-csrf before 3.0.0.
5
Is it safe to use fastify-csrf versions prior to 3.0.0?
No, using fastify-csrf versions prior to 3.0.0 is not safe due to the identified vulnerability.