-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the pre-patch implementation in csrf.go where ctx.SetCookie was called with a hardcoded 'false' for the secure parameter (6th argument). The Options struct contained a Secure flag that was not being utilized in this call, making it impossible to set secure cookies even when configured. The commit dadd171 specifically fixes this by replacing 'false' with opt.Secure in the Generate handler. This function is directly responsible for cookie generation and was the focal point of the vulnerability as shown in the diff and commit message.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/go-macaron/csrf | go | < 0.0.0-20180426211050-dadd1711a617 | 0.0.0-20180426211050-dadd1711a617 |
KEV Misses 88% of Exploited CVEs- Get the report