CVE-2018-20595: Cross-Site Request Forgery (CSRF) in hswebframework.web:hsweb-commons

org.hswebframework.web:hsweb-commons Updated 02 Oct 2025

Summary

04/01/2019

Disclosed on

CVE-2018-20595

CVE

No i

Fix available

High

Severity

8.8

CVSS Score

CVE-2018-20595: Cross-Site Request Forgery (CSRF) in hswebframework.web:hsweb-commons. Affects org.hswebframework.web:hsweb-commons versions < 3.0.4. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The hsweb-commons package is a part of the hswebframework.web ecosystem and is used for web development. It provides various utilities and components to simplify the development process. However, versions up to 3.0.4 of hsweb-commons are vulnerable to a Cross-Site Request Forgery (CSRF) attack.

Vulnerability Detail

The CSRF vulnerability in hsweb-commons arises from a failure to compare the state parameter in the request with the state parameter in the session after successful user authentication. This allows an attacker to forge requests on behalf of the authenticated user, potentially leading to unauthorized actions being performed. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability.

Conclusion

The CSRF vulnerability in hsweb-commons can be mitigated by updating to a patched version of the package. It is important to compare the state parameter in the request with the state parameter in the session after user authentication to prevent unauthorized actions. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for org.hswebframework.web:hsweb-commons →

FAQ

What is the impact of this vulnerability?

This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user, potentially leading to data breaches or other malicious activities.

Which versions of hsweb-commons are affected?

Versions up to 3.0.4 of hsweb-commons are affected by this vulnerability.

Is there a CVSS score for this vulnerability?

Yes, the CVSS score for this vulnerability is 8.8.

Are there any known exploits for this vulnerability?

There are no known exploits for this vulnerability at the moment.

How can I check if my application is affected?

You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert provides real-time monitoring and alerts for open-source vulnerabilities without requiring access to the code or installation.