CSRF vulnerability in save-server

Description

Versions prior to version v1.05 are affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version v1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version.

This is patched by implementing Double submit.

Recommendation

Update the save-server package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.5
• Patched version(s): 1.0.7

References

• GHSA-wwrj-35w6-77ff
• medium.com
• www.npmjs.com
• CVE-2020-15135
• CWE-352
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• PostCSS line return parsing error - CVE-2023-44270
• mavo DOM Clobbering vulnerability - CVE-2024-53388
• Cube API denial of service attack - CVE-2023-50709
• Prototype Pollution in protobufjs - CVE-2022-25878

Tags:

npm

save-server