CVE-2020-7780

Published November 27th, 2020

View on NVD ↗

CVSS v3

6.3

MEDIUM

CVSS v2

6.8

MEDIUM

Affected

PROJECT

Description

This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.

softwaremill/akka-http-session

Web & mobile client-side akka-http sessions, with optional JWT support

GitHub

438