CVE-2020-35217: eclipse vert.x-web Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2020-35217 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in eclipse vert.x-web. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 47% of scored vulnerabilities.
Timeline
- 20-01-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the session. An attacker does not even need to provide a CSRF token in the request because the framework does not consider it. The cookies are automatically sent by the browser and the verification will always succeed, leading to a successful CSRF attack.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.59%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
+0.01 pp
From 0.58% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Eclipse1 product
- vert.x-web4.0.0:milestone1 | 4.0.0:milestone2 | 4.0.0:milestone3 | 4.0.0:milestone4
Io.vertx1 product
- vertx-web≥ 4.0.0-milestone1, < 4.0.0-milestone5 | ≥ 4.0.0-milestone2, < 4.0.0-milestone5 | ≥ 4.0.0-milestone3, < 4.0.0-milestone5 | ≥ 4.0.0-milestone4, < 4.0.0-milestone5
2 vendors · 2 products
