Macaron csrf csrf.go missing secure attribute

published 2022-12-30 3 y ago modified 2026-06-17 4 mo ago also GHSA-hhxg-px5h-jc32 , GO-2022-1213 , EUVD-2022-7649

cvss: 3.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits: 0; none known

A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipulation of the argument Generate leads to sensitive cookie without secure attribute. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as dadd1711a617000b70e5e408a76531b73187031c. It is recommended to apply a patch to fix this issue. VDB-217058 is the identifier assigned to this vulnerability.

Patch / fix

fixed in 1 links 2

go github.com/go-macaron/csrf 0.0.0-20180426211050-dadd1711a617

github.com/go-macaron/csrf@dadd171 commit
github.com/go-macaron/csrf#7 pull request

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA	3.0	3.7	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA	2.0	2.6	AV:N/AC:H/Au:N/C:P/I:N/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
go	github.com/go-macaron/csrf	<0.0.0-20180426211050-dadd1711a617	0.0.0-20180426211050-dadd1711a617

Affected products

Macaron csrf

Classification

Weakness

CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE-311 Missing Encryption of Sensitive Data

References

github.com /go-macaron/csrf/pull/7
issue-tracking, web, patch, third-party-advisory
github.com /go-macaron/csrf/commit/dadd1711a617000b70e5e408a76531b73187031c
patch, web, third-party-advisory
vuldb.com /?id.217058
vdb-entry, technical-description, web, third-party-advisory
vuldb.com /?ctiid.217058
signature, permissions-required, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2018-25060
advisory
github.com /go-macaron/csrf
package
pkg.go.dev /vuln/GO-2022-1213
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary