Togglz console missing cross-site request forgery (CSRF) protection

HIGH 8.8CVE-2020-28191 · GHSA-697v-pxg3-j262 · Published 26/12/2022 · updated 17/06/2026

In short

CVE-2020-28191 is a HIGH (CVSS 8.8) vulnerability affecting org.togglz:togglz-console, togglz (togglz).
Chance of exploitation in the next 30 days (EPSS): 0.41%, higher than 35.8% of all vulnerabilities.
Fix: update to 2.9.4 or later.

Package	Affected versions	Patched versions
org.togglz:togglz-console Maven	`< 2.9.4`	`2.9.4`
togglz togglz	`< 2.9.4`	`2.9.4`

Description

Togglz is an implementation of the Feature Toggles pattern for Java. There is no CSRF protection in the togglz console and could allow an attacker to guess the CSRF token value. Version 2.9.4 adds the necessary CSRF protection.

NVD description

The console in Togglz before 2.9.4 allows CSRF.

References

nvd.nist.gov/vuln/detail/CVE-2020-28191 · ADVISORY
togglz/togglz#495 · WEB
togglz/togglz commit ed66e3f · WEB
togglz/togglz · PACKAGE
mend.io/vulnerability-database/CVE-2020-28191 · WEB
GitHub Advisory GHSA-697v-pxg3-j262 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free