CVE-2020-7780

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Nov 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-77819.8This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrat CVE-2020-77829.8This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in CVE-2020-77849.8This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-CVE-2020-77859.8This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js.CVE-2020-77869.8This affects all versions of package macfromip. The injection point is located in line 66 in macfromip.js.CVE-2020-77878.2This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, sessi CVE-2020-77889.8This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they CVE-2020-77895.6This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options pa CVE-2020-77905.3This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary CVE-2020-77917.5This affects the package i18n before 2.1.15. Vulnerability arises out of insufficient handling of erroneous language tags in src/i18n/Concre CVE-2020-77927.5This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn CVE-2020-77937.5The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit