CVE-2016-10535

low-risk

Published 2018-05-31

csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than (16*18)288 guesses, instead of the 16^18 guesses required were the timing attack not present.

Do I need to act?

0.30% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.9/10 Medium

NETWORK / HIGH complexity

Affected Products (1)

Csrf-Lite

Affected Vendors

Csrf-Lite Project

References (4)

Third Party Advisory https://github.com/isaacs/csrf-lite/pull/1

Third Party Advisory https://nodesecurity.io/advisories/94

Third Party Advisory https://github.com/isaacs/csrf-lite/pull/1

Third Party Advisory https://nodesecurity.io/advisories/94

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal