CVE-2018-12540: eclipse vert.x Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2018-12540 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in eclipse vert.x. EPSS estimates a 1.99% chance of exploitation in the next 30 days, higher than 80.3% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 12-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.99%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
0.00 pp
From 1.99% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (bugs.eclipse.org)
Maturity: unknown
Exploit Reference (access.redhat.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Eclipse1 product
- vert.x≥ 3.0.0, ≤ 3.5.2
Io.vertx1 product
- vertx-web≥ 3.0.0, < 3.5.3
The eclipse foundation1 product
- eclipse vert.x≥ 3.0, < unspecified | ≥ unspecified, ≤ 3.5.2
3 vendors · 3 products
References
15 links- access.redhat.com/errata/RHSA-2018:2371Vendor AdvisoryX Refsource REDHATExploitThird Party AdvisoryWEB
Show all 15 references
- github.com/vert-x3/vertx-webPACKAGE