GHSA-6wqp-7g94-f69j
sensiolabs/connect has a Cross-Site Request Forgery Vulnerability
GHSA-6wqp-7g94-f69j is a medium vulnerability (CVSS 6.1) in sensiolabs/connect, published May 21, 2024. No source lists public exploit code. Fixed in sensiolabs/connect 4.2.3.
- Severity
- 6.1 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.2.3sensiolabs/connect +1 more
Description
Versions of sensiolabs/connect prior to 4.2.3 are affected by a Cross-Site Request Forgery (CSRF) vulnerability due to the absence of the state parameter in OAuth requests. The lack of proper state parameter handling exposes applications to CSRF attacks during the OAuth authentication flow.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sensiolabs/connectPackagist | before 4.2.3 | 4.2.3 |
sensiolabs/connectPackagist | before 4.2.3, plus listed versions v1.0v1.1v1.2v1.3v1.4 Show 15 moreShow lessv1.5v1.6v1.7v1.8v1.9v2.0.0v2.0.1v2.0.2v2.1.0v3.0.0v4.0.0v4.1.0v4.2.0v4.2.1v4.2.2 | 4.2.3 |
What each source reports
GitHub Advisories Score used
sensiolabs/connect has a Cross-Site Request Forgery Vulnerability
Versions of sensiolabs/connect prior to 4.2.3 are affected by a Cross-Site Request Forgery (CSRF) vulnerability due to the absence of the state parameter in OAuth requests. The lack of proper state parameter handling exposes applications to CSRF attacks during the OAuth authentication flow.
- Record
GHSA-6wqp-7g94-f69j- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
sensiolabs/connect has a Cross-Site Request Forgery Vulnerability
Versions of sensiolabs/connect prior to 4.2.3 are affected by a Cross-Site Request Forgery (CSRF) vulnerability due to the absence of the state parameter in OAuth requests. The lack of proper state parameter handling exposes applications to CSRF attacks during the OAuth authentication flow.
- Record
GHSA-6wqp-7g94-f69j- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.