CVE-2018-25060 Macaron csrf csrf.go missing secure attribute
The Macaron CSRF library fails to set the Secure attribute on cookies, allowing potential interception of CSRF tokens over unencrypted connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-25060?
CVE-2018-25060 is a low-severity vulnerability in Macaron csrf, published on 30 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipulation of the argument Generate leads to sensitive cookie without secure attribute. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as dadd1711a617000b70e5e408a76531b73187031c. It is recommended to apply a patch to fix this issue. VDB-217058 is the identifier assigned to this vulnerability.
Which versions are affected by CVE-2018-25060?
3 open source packages ship an affected version, including github.com/go-macaron/csrf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-macaron/csrf Go | All versions | 0.0.0-20180426211050-dadd1711a617 |
github.com/go-macaron/csrf Go | All versions | 0.0.0-20180426211050-dadd1711a617 |
github.com/go-macaron/csrf Go | All versions | 0.0.0-20180426211050-dadd1711a617 |
Products include Go-Macaron Csrf.
How do I fix CVE-2018-25060?
Upgrade github.com/go-macaron/csrf to 0.0.0-20180426211050-dadd1711a617 or later.
Is CVE-2018-25060 being exploited?
There is no known exploitation of CVE-2018-25060 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2018-25060, GHSA-hhxg-px5h-jc32, GO-2022-1213, UBUNTU-CVE-2018-25060.