Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2013-7464: csrf-magic allows attackers to bypass CSRF protection
CVE-2013-7464 · published 8 years ago
Summary
The csrf-magic library can generate the same security token for every user if its secret setting is left empty. This makes it possible for a malicious site to trick users into performing unwanted actions on your web application. Configure a unique secret value or upgrade to version 1.0.4 or later to fix the issue.
What to do
- Update csrf-magic_project csrf-magic to version 1.0.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| csrf-magic_project | csrf-magic |
< 1.0.4 cpe:2.3:a:csrf-magic_project:csrf-magic:*:*:*:*:*:*:*:* |
Original advisory text
In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automati...
In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used.
References
- http://csrf.htmlpurifier.org/news/2013/0717-1.0.4-released Release Notes Vendor Advisory
- http://repo.or.cz/csrf-magic.git/blob/HEAD:/NEWS.txt Release Notes Third Party Advisory
- http://repo.or.cz/csrf-magic.git/commit/9d2537f70d58b16aeba89779aaf1573b8d618e11 Patch Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published8 Aug 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2013-7464 · NVD
Track software like this
Free during beta