CVE-2018-12540 – vertx-web: Incomplete CSRF validation by CSRFHandler

https://notcve.org/view.php?id=CVE-2018-12540

In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet. Desde la versión 3.0.0 hasta la 3.5.2 de Eclipse Vert.x, CSRFHandler no aseveró que la cookie XSRF coincidía con la cabecera XSRF/ parámetro form. Esto permite ataques de reproducción con tokens previamente subidos que aún no han caducado. • https://github.com/tafamace/CVE-2018-12540 https://access.redhat.com/errata/RHSA-2018:2371 https://bugs.eclipse.org/bugs/show_bug.cgi?id=536948 https://lists.apache.org/thread.html/r10aef585c521f8ef603f5831f9d97a27d920624025131da950e0c62f%40%3Ccommits.pulsar.apache.org%3E https://lists.apache.org/thread.html/r3fffda8e947edaa359152c8dc4c4ea9c96fd8ced1999bbce92bc6b25%40%3Ccommits.pulsar.apache.org%3E https://lists.apache.org/thread.html/r59482ebed302aa49ac7e0c51737499746b0d086fcdeb8f90e705951f%40%3Ccommits.pulsar.apache.org%3E https://lists.apache • CWE-352: Cross-Site Request Forgery (CSRF) •