CVE-2020-36564

HIGH EPSS 49.3%
Published Dec 27, 20223y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Dec 27, 2022 3y ago
Last Modified Jun 17, 2026 2w ago

Description

Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
49.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-20 Improper Input Validation Validation

Affected Products 1

VendorProductVersionRange
nosurf_projectnosurf* <1.1.1

References 3

  • github.com https://github.com/justinas/nosurf/commit/4d86df7a4affa1fa50ab39fb09aac56c3ce9c314
    PatchThird Party Advisory
  • github.com https://github.com/justinas/nosurf/pull/60
    PatchThird Party Advisory
  • pkg.go.dev https://pkg.go.dev/vuln/GO-2020-0049
    Third Party Advisory

Remediation

  • github.com https://github.com/justinas/nosurf/commit/4d86df7a4affa1fa50ab39fb09aac56c3ce9c314
    PatchThird Party Advisory
  • github.com https://github.com/justinas/nosurf/pull/60
    PatchThird Party Advisory