CVE-2019-25091 nsupdate.info CSRF Cookie base.py cookie httponly flag
Missing HttpOnly flag on CSRF cookies in nsupdate.info allows JavaScript access, potentially facilitating cross-site request forgery attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-25091?
CVE-2019-25091 is a low-severity vulnerability in nsupdate.info, published on 27 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability classified as problematic has been found in nsupdate.info. This affects an unknown part of the file src/nsupdate/settings/base.py of the component CSRF Cookie Handler. The manipulation of the argument CSRF_COOKIE_HTTPONLY leads to cookie without 'httponly' flag. It is possible to initiate the attack remotely. The name of the patch is 60a3fe559c453bc36b0ec3e5dd39c1303640a59a. It is recommended to apply a patch to fix this issue. The identifier VDB-216909 was assigned to this vulnerability.
Weakness: CWE-1004
Which versions are affected by CVE-2019-25091?
3 open source packages ship an affected version, including nsupdate. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nsupdate PyPI | All versions to 0.12.0 | None |
nsupdate PyPI | All versions to 0.12.0 | None |
nsupdate PyPI | All versions | 0.13.0 |
Products include Nsupdate Nsupdate.info.
How do I fix CVE-2019-25091?
Upgrade nsupdate to 0.13.0 or later.
Is CVE-2019-25091 being exploited?
There is no known exploitation of CVE-2019-25091 in the wild and no public exploit code.
Sources
Also known as GHSA-mwvp-qr62-cvjx, PYSEC-2026-885.