Togglz console missing cross-site request forgery (CSRF) protection

GHSA-697v-pxg3-j262 · CVE-2020-28191

Published Jul 15, 2022 · Modified Jul 8, 2026

Description

Togglz is an implementation of the Feature Toggles pattern for Java. There is no CSRF protection in the togglz console and could allow an attacker to guess the CSRF token value. Version 2.9.4 adds the necessary CSRF protection.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-28191
WEB https://github.com/togglz/togglz/pull/495
WEB https://github.com/togglz/togglz/commit/ed66e3f584de954297ebaf98ea4a235286784707
PACKAGE https://github.com/togglz/togglz
WEB https://www.mend.io/vulnerability-database/CVE-2020-28191

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes