-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from CSRF tokens being retrievable using only session tokens. The JavaScriptServlet is responsible for generating dynamic JavaScript containing CSRF tokens. In versions ≤3.1.0, it likely lacked proper origin/referer validation, allowing attackers to exfiltrate tokens via cross-origin requests. The patched version (4.0.0) introduced stricter CORS/referer checks, as implied by advisory notes requiring clients to respect CORS for proper protection. This aligns with the JavaScriptServlet's role in token injection and its configuration parameters (e.g., referer-pattern, domain-strict), which were insufficiently enforced in vulnerable versions.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.owasp:csrfguard | maven | <= 3.1.0 | 4.0.0 |
KEV Misses 88% of Exploited CVEs- Get the report