nosurf vulnerable to improper input validation

ALTO 7.5CVE-2020-36564 · GHSA-5x84-q523-vvwr · GO-2020-0049 · Published 27/12/2022 · updated 17/06/2026

In breve

CVE-2020-36564 è una vulnerabilità ALTO (CVSS 7.5) che riguarda github.com/justinas/nosurf, nosurf (nosurf project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.78%, superiore al 56.2% delle vulnerabilità.
Correzione: aggiornare a 1.1.1 o successiva.

Package	Affected versions	Patched versions
github.com/justinas/nosurf Go	`< 1.1.1`	`1.1.1`
nosurf nosurf_project	`< 1.1.1`	`1.1.1`

Description

Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.

NVD description

Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.

References

nvd.nist.gov/vuln/detail/CVE-2020-36564 · ADVISORY
justinas/nosurf#60 · WEB
justinas/nosurf commit 4d86df7 · WEB
justinas/nosurf · PACKAGE
pkg.go.dev/vuln/GO-2020-0049 · WEB

Altre vulnerabilità di github.com/justinas/nosurf

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free