CVE-2018-25060 json
Macaron csrf csrf.go missing secure attribute
published 3y ago modified 4mo ago also GHSA-hhxg-px5h-jc32 , GO-2022-1213 , EUVD-2022-7649
- cvss
- 3.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipulation of the argument Generate leads to sensitive cookie without secure attribute. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as dadd1711a617000b70e5e408a76531b73187031c. It is recommended to apply a patch to fix this issue. VDB-217058 is the identifier assigned to this vulnerability.
Patch / fix
- go github.com/go-macaron/csrf 0.0.0-20180426211050-dadd1711a617
- github.com/go-macaron/csrf@dadd171 commit
- github.com/go-macaron/csrf#7 pull request
Is CVE-2018-25060 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
0.56% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.0 | 3.7 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 2.0 | 2.6 | AV:N/AC:H/Au:N/C:P/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/go-macaron/csrf | <0.0.0-20180426211050-dadd1711a617 |
0.0.0-20180426211050-dadd1711a617 |
Affected products
- Macaron csrf
Classification
References
-
github.com
/go-macaron/csrf/pull/7
issue-tracking, web, patch, third-party-advisory
-
github.com
/go-macaron/csrf/commit/dadd1711a617000b70e5e408a76531b73187031c
patch, web, third-party-advisory
-
vuldb.com
/?id.217058
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.217058
signature, permissions-required, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2018-25060
advisory
-
github.com
/go-macaron/csrf
package
-
pkg.go.dev
/vuln/GO-2022-1213
web
Sources
- CVE List CVE-2018-25060
- GitHub Advisory GHSA-hhxg-px5h-jc32
- NVD CVE-2018-25060
- OSV GO-2022-1213
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.