CVE-2019-19737 - MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requests and potentially be used in cross-site request forgery attacks

Back Back to CVE browser

HIGH

MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requests and potentially be used in cross-site request forgery attacks

Published Dec 30, 2019

8.8

HIGH

CVSS 3.1

EPSS 0.46%

Description

MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requests and potentially be used in cross-site request forgery attacks.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9338
Advisory
https://medium.com/%40jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459
x_refsource_MISC

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9338		Advisory
https://medium.com/%40jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459		x_refsource_MISC