CVE-2018-12540 — Vulnetix

CVE-2018-12540 PUBLISHED CVSS 5.099999904632568 MEDIUM

In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet.

EPSS 2.45% · 85.5th percentile

Risk Scores

CVSS 4.0

5.099999904632568

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS Score

2.45%

85.5th percentile

Affected Products

Vendor	Product	Versions
The Eclipse Foundation	Eclipse Vert.x	3.0, unspecified
Maven	io.vertx:vertx-web	3.0.0
eclipse	vert.x	3.0.0

Exploit Intelligence

tafamace/CVE-2018-12540 (github-poc-repo)
tafamace/CVE-2018-12540 (github-poc-repo)
tafamace/CVE-2018-12540 (github-poc-repo)
tafamace/CVE-2018-12540 (github-poc-repo)
tafamace/CVE-2018-12540 (github-poc-repo)
tafamace/CVE-2018-12540 (github-poc-repo)
tafamace/CVE-2018-12540 (github-poc)
tafamace/CVE-2018-12540 (github-poc)
tafamace/CVE-2018-12540 (github-poc)
tafamace/CVE-2018-12540 (github-poc)

…and 12 more exploits

Timeline

Jul 12, 2018 CVE Published
Apr 14, 2021 EPSS Score
Jun 23, 2021 EPSS Score
Oct 26, 2021 EPSS Score
Dec 27, 2021 EPSS Score
Feb 4, 2022 EPSS Score
May 2, 2022 EPSS Score
Jul 3, 2022 EPSS Score
Sep 5, 2022 EPSS Score
Jan 8, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 11, 2023 EPSS Score

References

Open in Interactive Console →