CVE-2020-7780 Cross-site Request Forgery (CSRF)
Attackers can bypass CSRF protection in Akka HTTP session library by sending empty headers and cookies, requiring specific configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-7780?
CVE-2020-7780 is a medium-severity vulnerability in com.softwaremill.akka-http-session:core_2.11, published on 27 Nov 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.
Weakness: CWE-352
Which versions are affected by CVE-2020-7780?
6 open source packages ship an affected version, including com.softwaremill.akka-http-session:core_2.11, com.softwaremill.akka-http-session:core_2.12 and com.softwaremill.akka-http-session:core_2.13. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.softwaremill.akka-http-session:core_2.11 Maven | All versions | 0.5.11 |
com.softwaremill.akka-http-session:core_2.11 Maven | All versions | 0.5.11 |
com.softwaremill.akka-http-session:core_2.12 Maven | All versions | 0.5.11 |
com.softwaremill.akka-http-session:core_2.12 Maven | All versions | 0.5.11 |
com.softwaremill.akka-http-session:core_2.13 Maven | All versions | 0.5.11 |
com.softwaremill.akka-http-session:core_2.13 Maven | All versions | 0.5.11 |
Products include Softwaremill Akka-Http-Session.
How do I fix CVE-2020-7780?
Upgrade com.softwaremill.akka-http-session:core_2.11 to 0.5.11 or later.
Is CVE-2020-7780 being exploited?
There is no known exploitation of CVE-2020-7780 in the wild and no public exploit code.
Other vulnerabilities in com.softwaremill.akka-http-session:core_2.11
Sources
Also known as GHSA-q42q-523g-3fwv.