CVE-2018-12540 High severity vulnerability that affects io.vertx:vertx-web
Attackers can bypass CSRF protections in Eclipse Vert.x by replaying valid tokens, potentially allowing unauthorized actions on behalf of users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-12540?
CVE-2018-12540 is a high-severity vulnerability in The Eclipse Foundation Eclipse Vert.x, published on 12 Jul 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet.
Weakness: CWE-352
Which versions are affected by CVE-2018-12540?
2 open source packages ship an affected version, including io.vertx:vertx-web. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.vertx:vertx-web Maven | From 3.0.0 | 3.5.3 |
io.vertx:vertx-web Maven | From 3.0.0 | 3.5.3 |
Products include Eclipse Vert.x.
How do I fix CVE-2018-12540?
Upgrade io.vertx:vertx-web to 3.5.3 or later.
Is CVE-2018-12540 being exploited?
There is no known exploitation of CVE-2018-12540 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in The Eclipse Foundation Eclipse Vert.x
- CVE-2019-17640 Path Traversal in Eclipse Vert
- CVE-2018-12542 Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location
- CVE-2018-12544 Moderate severity vulnerability that affects io.vertx:vertx-core
- CVE-2026-102469 Deserialization in Eclipse Vert.x
- CVE-2026-102461 Denial of service in Eclipse Vert.x
Sources
Also known as GHSA-rvgg-f8qm-6h7j.