GHSA-6wqp-7g94-f69j
GHSA-6wqp-7g94-f69j · sensiolabs/connect has a Cross-Site Request Forgery Vulnerability
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Versions of sensiolabs/connect prior to 4.2.3 are affected by a Cross-Site Request Forgery (CSRF) vulnerability due to the absence of the state parameter in OAuth requests. The lack of proper state parameter handling exposes applications to CSRF attacks during the OAuth authentication flow.
CVSS 6.1 · Media · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
sensiolabs/connect Packagist
- Versiones
- v1.0
- v1.1
- v1.2
- v1.3
- v1.4
- v1.5
- v1.6
- v1.7
- v1.8
- v1.9
- v2.0.0
- v2.0.1
- v2.0.2
- v2.1.0
- v3.0.0
- v4.0.0
- v4.1.0
- v4.2.0
- v4.2.1
- v4.2.2
- Intervalos de versiones afectados
- ECOSYSTEM: < 4.2.3
Actualiza a 4.2.3
Fuentes originales
- https://github.com/sensiolabs/connect/pull/63
- https://github.com/symfonycorp/connect/commit/9522aa774e8a0f8a61e709d828e6cc34c4c1e703
- https://github.com/FriendsOfPHP/security-advisories/blob/master/sensiolabs/connect/2018-06-08-1.yaml
- https://github.com/symfonycorp/connect
- https://osv.dev/vulnerability/GHSA-6wqp-7g94-f69j