Vulnerability	Vulnerable Version
H Cross-site Request Forgery (CSRF) io.vertx:vertx-web is a HTTP web applications for Vert.x. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). Vert.x-Web framework does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the session. An attacker does not even need to provide a CSRF token in the request because the framework does not consider it. The cookies are automatically sent by the browser and the verification will always succeed, leading to a successful CSRF attack. How to fix Cross-site Request Forgery (CSRF)? Upgrade `io.vertx:vertx-web` to version 4.0.0-milestone5 or higher.	[4.0.0-milestone1,4.0.0-milestone5)

Cross-site Request Forgery (CSRF)

io.vertx:vertx-web is a HTTP web applications for Vert.x.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). Vert.x-Web framework does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the session. An attacker does not even need to provide a CSRF token in the request because the framework does not consider it. The cookies are automatically sent by the browser and the verification will always succeed, leading to a successful CSRF attack.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade io.vertx:vertx-web to version 4.0.0-milestone5 or higher.

[4.0.0-milestone1,4.0.0-milestone5)

Go back to all versions of this package