CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-38513 – Fiber Session Middleware Token Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-38513
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted. The issue has been addressed in version 2.52.5. • https://github.com/gofiber/fiber/commit/66a881441b27322a331f1b526cf1eb6b3358a4d8 https://github.com/gofiber/fiber/security/advisories/GHSA-98j2-3j3p-fw2v • CWE-384: Session Fixation •
CVSS: 9.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25124 – Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
https://notcve.org/view.php?id=CVE-2024-25124
Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard (`*`) while also having the Access-Control-Allow-Credentials set to true, which goes against recommended security best practices. The impact of this misconfiguration is high as it can lead to unauthorized access to sensitive user data and expose the system to various types of attacks listed in the PortSwigger article linked in the references. Version 2.52.1 contains a patch for this issue. • http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html https://codeql.github.com/codeql-query-help/javascript/js-cors-misconfiguration-for-credentials https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials https://fetch.spec.whatwg.org/#cors-protocol-and-credentials https://github.com/gofiber/fiber/commit/f0cd3b44b086544a37886232d0530601f2406c23 https://github.com/gofiber/fiber/releases/tag/v2.52.1 https://github.com/gofiber/fiber/security/advisories/GHSA • CWE-346: Origin Validation Error CWE-942: Permissive Cross-domain Policy with Untrusted Domains •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22199 – Django Template Engine Vulnerable to XSS
https://notcve.org/view.php?id=CVE-2024-22199
This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users' browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks. Este paquete proporciona métodos universales para usar múltiples motores de plantillas con el framework web de Fiber mediante la interfaz de Views. Esta vulnerabilidad afecta específicamente a las aplicaciones web que procesan datos proporcionados por el usuario a través de este motor de plantillas, lo que podría provocar la ejecución de scripts maliciosos en los navegadores de los usuarios cuando visitan las páginas web afectadas. • https://github.com/gofiber/template/commit/28cff3ac4d4c117ab25b5396954676d624b6cb46 https://github.com/gofiber/template/security/advisories/GHSA-4mq2-gc4j-cmw6 • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-116: Improper Encoding or Escaping of Output •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45141 – CSRF Token Validation Vulnerability in fiber
https://notcve.org/view.php?id=CVE-2023-45141
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This vulnerability has been addressed in version 2.50.0 and users are advised to upgrade. • https://github.com/gofiber/fiber/security/advisories/GHSA-mv73-f69x-444p • CWE-352: Cross-Site Request Forgery (CSRF) CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45128 – CSRF Token Reuse Vulnerability in fiber
https://notcve.org/view.php?id=CVE-2023-45128
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated user, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This issue has been addressed in version 2.50.0 and users are advised to upgrade. • https://github.com/gofiber/fiber/commit/8c3916dbf4ad2ed427d02c6eb63ae8b2fa8f019a https://github.com/gofiber/fiber/security/advisories/GHSA-94w9-97p3-p368 • CWE-20: Improper Input Validation CWE-352: Cross-Site Request Forgery (CSRF) CWE-565: Reliance on Cookies without Validation and Integrity Checking CWE-807: Reliance on Untrusted Inputs in a Security Decision •