CVE-2023-45141

CSRF Token Validation Vulnerability in fiber

State: Published
Severity: 8.6 High
Published: Oct 16, 2023
Updated: Sep 16, 2024
Reserved: Oct 4, 2023

Description

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This vulnerability has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L	GitHub_M

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)
CWE-565 Reliance on Cookies without Validation and Integrity Checking

Affected Products

Product	Versions
fibergofiber	< 2.50.0Affected

References

https://github.com/gofiber/fiber/security/advisories/GHSA-mv73-f69x-444p

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.