GHSA-6wqp-7g94-f69j
GHSA-6wqp-7g94-f69j · sensiolabs/connect has a Cross-Site Request Forgery Vulnerability
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Versions of sensiolabs/connect prior to 4.2.3 are affected by a Cross-Site Request Forgery (CSRF) vulnerability due to the absence of the state parameter in OAuth requests. The lack of proper state parameter handling exposes applications to CSRF attacks during the OAuth authentication flow.
CVSS 6.1 · Moyenne · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
sensiolabs/connect Packagist
- Versions du logiciel
- v1.0
- v1.1
- v1.2
- v1.3
- v1.4
- v1.5
- v1.6
- v1.7
- v1.8
- v1.9
- v2.0.0
- v2.0.1
- v2.0.2
- v2.1.0
- v3.0.0
- v4.0.0
- v4.1.0
- v4.2.0
- v4.2.1
- v4.2.2
- Plages de versions concernées
- ECOSYSTEM: < 4.2.3
Mettez à jour vers 4.2.3
Sources originales
- https://github.com/sensiolabs/connect/pull/63
- https://github.com/symfonycorp/connect/commit/9522aa774e8a0f8a61e709d828e6cc34c4c1e703
- https://github.com/FriendsOfPHP/security-advisories/blob/master/sensiolabs/connect/2018-06-08-1.yaml
- https://github.com/symfonycorp/connect
- https://osv.dev/vulnerability/GHSA-6wqp-7g94-f69j