CVE-2018-20595: Cross-Site Request Forgery (CSRF)

January 4, 2019 (updated September 1, 2021)

A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful.

References

github.com/advisories/GHSA-4rm3-4mq4-mfwr
github.com/hs-web/hsweb-framework/commit/40929e9b0d336a26281a5ed2e0e721d54dd8d2f2
github.com/hs-web/hsweb-framework/issues/107
nvd.nist.gov/vuln/detail/CVE-2018-20595

Code Behaviors & Features

Detect and mitigate CVE-2018-20595 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →