{"id":"CVE-2020-36625","aliases":["EUVD-2022-7600","GHSA-cjcc-46j8-xmr8"],"status":"published","title":"destiny.gg chat main.go websocket.Upgrader cross-site request forgery","description":"A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00372,"percentile":0.31467,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352","CWE-863"],"published":"2022-12-22T00:00:00Z","modified":"2026-10-20T10:53:26Z","affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/destinygg/chat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.0-20220628124252-0981d5add8f3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/destinygg/chat","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.0.0-20220628124252-0981d5add8f3"}]}]}],"products":[{"vendor":"destiny","product":"chat"},{"vendor":"destiny.gg","product":"chat"}],"references":[{"url":"https://github.com/destinygg/chat/pull/35","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/destinygg/chat/commit/bebd256fc3063111fb4503ca25e005ebf6e73780","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://vuldb.com/?id.216521","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36625","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cjcc-46j8-xmr8"},{"url":"https://github.com/destinygg/chat","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-36625","title":"destiny.gg chat main.go websocket.Upgrader cross-site request forgery","description":"A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2024-08-04T17:30:08.328Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:35:55.128961Z"}],"euvd":[{"id":"EUVD-2022-7600","description":"A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2024-08-04T17:30:08Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:07:02.510914Z"}],"ghsa":[{"id":"GHSA-cjcc-46j8-xmr8","title":"destiny.gg chat vulnerable to cross-site request forgery","description":"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2022-12-22T12:30:17Z","modified":"2024-03-21T17:39:21Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352","CWE-863"],"updated_at":"2026-11-02T14:37:41.821668Z"}],"nvd":[{"id":"CVE-2020-36625","description":"A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2022-12-22T10:15:09.73Z","modified":"2026-06-17T03:15:49.97Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-863","CWE-352"],"updated_at":"2026-11-02T14:06:47.286386Z"}],"osv":[{"id":"CVE-2020-36625","description":"A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2022-12-22T10:15:09.73Z","modified":"2026-10-20T10:53:26.868078871Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"GHSA-cjcc-46j8-xmr8","title":"destiny.gg chat vulnerable to cross-site request forgery","description":"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2022-12-22T12:30:17Z","modified":"2024-03-21T17:39:21Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352","CWE-863"],"updated_at":"2026-11-02T15:46:45.28161Z"}]}}