crumb@0.3.0 vulnerabilities
CSRF crumb generation and validation plugin
-
latest version
7.2.3
-
latest non vulnerable version
-
first published
12 years ago
-
latest version published
6 years ago
-
licenses detected
- >=0.0.1 <6.0.0
Direct Vulnerabilities
Known vulnerabilities in the crumb package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.Vulnerability | Vulnerable Version |
---|---|
Affected versions of the package are vulnerable to Authentication Bypass. How to fix Authentication Bypass? Upgrade |
<4.0.2
|
When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user. A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all. Source: Node Security Project How to fix CORS Token Disclosure? Update crumb to version 3.0.0 or greater. |
<3.0.0
|