CVE-2020-7780: Cross-site Request Forgery (CSRF)
This affects the package com.softwaremill.akka-http-session:core2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-7780?
CVE-2020-7780 has been classified as a high-severity vulnerability.
How do I fix CVE-2020-7780?
To mitigate CVE-2020-7780, upgrade to version 0.5.11 or later of the Akka HTTP Session package.
What impact does CVE-2020-7780 have on affected systems?
CVE-2020-7780 can potentially allow unauthorized access to endpoints protected by randomTokenCookie due to insufficient security measures.
Which software versions are affected by CVE-2020-7780?
CVE-2020-7780 affects versions earlier than 0.5.11 of the Akka HTTP Session package for Scala 2.11, 2.12, and 2.13.
Is there a workaround for CVE-2020-7780?
There is no official workaround for CVE-2020-7780; the best course of action is to upgrade to the patched version.