| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| payload | < 3.79.1 | 3.79.1 |
| payload | < 3.79.1 | 3.79.1 |
A Cross-Site Request Forgery (CSRF) vulnerability existed in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made.
Consumers are affected if ALL of these are true:
serverURL is configuredThis vulnerability has been patched in v3.79.1. Additional validation has been added to the authentication flow.
Consumers should upgrade to v3.79.1 or later.
There is no complete workaround without upgrading.
If consumers cannot upgrade immediately, setting cookies.sameSite to 'Strict' will prevent the session cookie from being sent cross-site. However, this will also require users to re-authenticate when navigating to the application from external links (e.g. email, other sites).
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン