CVE-2023-45128

Gofiber Fiber vulnerability

10.0 CRITICALEPSS 0.31%

Published16 Oct 2023

Description

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated user, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This issue has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes as defense in depth measures. There are no known workarounds for this vulnerability.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityLow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Affected products

Gofiber Fiber< 2.50.0

Remediation

Fixed in

Gofiber Fiber≥ 2.50.0

Frequently asked

Is CVE-2023-45128 being actively exploited?

CVE-2023-45128 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.31%.

How severe is CVE-2023-45128?

CVE-2023-45128 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 0.31% probability of exploitation.

Which products are affected by CVE-2023-45128?

Affected products include Gofiber Fiber.

How do I fix CVE-2023-45128?

Upgrade affected software to a fixed version, for example Gofiber Fiber 2.50.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-45128 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.