CVE-2016-10535
Medium
Description
csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than (16*18)288 guesses, instead of the 16^18 guesses required were the timing attack not present.
SeverityMedium
CVSS5.9
Exploit probability—
ProductCsrf-lite
PublishedMay 31, 2018
First seenMay 31, 2018
Weakness typeCWE-208CWE-208
How to fix
Update
- csrf-lite0.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| csrf-lite_project csrf-lite | v ≤ 0.1.1 | — |
| csrf-litenpm | v < 0.1.2 | 0.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.