CVE-2022-39287
Plaintext transmission of CSRF tokens in tiny-csrf
- State
- Published
- Severity
- 8.1 High
- Published
- Oct 7, 2022
- Updated
- Apr 23, 2025
- Reserved
- Sep 2, 2022
Description
tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit `8eead6d` and the patch with be included in version 1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | GitHub_M |
Weaknesses
- CWE-319 Cleartext Transmission of Sensitive Information
Affected Products
| Product | Versions |
|---|---|
tiny-csrfvalexandersaulys |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.