GHSA-6wqp-7g94-f69j
GHSA-6wqp-7g94-f69j · sensiolabs/connect has a Cross-Site Request Forgery Vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Versions of sensiolabs/connect prior to 4.2.3 are affected by a Cross-Site Request Forgery (CSRF) vulnerability due to the absence of the state parameter in OAuth requests. The lack of proper state parameter handling exposes applications to CSRF attacks during the OAuth authentication flow.
CVSS 6.1 · Medium · Fix available
- Published
- Updated
Stack: php
Affected products and versions
sensiolabs/connect Packagist
- Versions
- v1.0
- v1.1
- v1.2
- v1.3
- v1.4
- v1.5
- v1.6
- v1.7
- v1.8
- v1.9
- v2.0.0
- v2.0.1
- v2.0.2
- v2.1.0
- v3.0.0
- v4.0.0
- v4.1.0
- v4.2.0
- v4.2.1
- v4.2.2
- Affected ranges
- ECOSYSTEM: < 4.2.3
Update to 4.2.3
Original sources
- https://github.com/sensiolabs/connect/pull/63
- https://github.com/symfonycorp/connect/commit/9522aa774e8a0f8a61e709d828e6cc34c4c1e703
- https://github.com/FriendsOfPHP/security-advisories/blob/master/sensiolabs/connect/2018-06-08-1.yaml
- https://github.com/symfonycorp/connect
- https://osv.dev/vulnerability/GHSA-6wqp-7g94-f69j