Fluid Attacks Database

Description

Axios Cross-Site Request Forgery Vulnerability An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	axios	>=1.0.0 <1.6.0 \|\| >=0.8.1 <0.28.0	1.6.0, 0.28.0
debian 13	node-axios	>=0 <1.6.2+dfsg-1	1.6.2+dfsg-1
debian 11	node-axios	=0.21.1+dfsg-1 \|\| =0.21.1+dfsg-1+deb11u1 \|\| =0.21.3+dfsg-1 \|\| =0.21.4+dfsg-1 \|\| =0.22.0+dfsg-1 \|\| =0.23.0+dfsg-1 \|\| =0.23.0+dfsg-2 \|\| =0.24.0+dfsg-1 \|\| =0.25.0+dfsg-1 \|\| =0.25.0+dfsg-2 \|\| =0.26.0+dfsg-1 \|\| =0.26.1+dfsg-1 \|\| =0.26.1+dfsg-2 \|\| =0.27.2+dfsg-1 \|\| =0.27.2+dfsg-2 \|\| =1.1.2+dfsg-1 \|\| =1.1.2+dfsg-2 \|\| =1.1.2+dfsg-3 \|\| =1.1.3+dfsg-1 \|\| =1.1.3+dfsg-2 \|\| =1.11.0+dfsg-1 \|\| =1.12.1+dfsg-1 \|\| =1.13.1+dfsg-1 \|\| =1.13.2+dfsg-1 \|\| =1.14.0+dfsg-1 \|\| =1.15.0-1 \|\| =1.15.2-1 \|\| =1.16.0-1 \|\| =1.18.0-1 \|\| =1.2.0+dfsg-1 \|\| =1.2.1+dfsg-1 \|\| =1.5.1+dfsg-1 \|\| =1.6.2+dfsg-1 \|\| =1.6.8+dfsg-1 \|\| =1.6.8+dfsg-2 \|\| =1.7.3+dfsg-1 \|\| =1.7.4+dfsg-1 \|\| =1.7.7+dfsg-1 \|\| =1.7.9+dfsg-1 \|\| =1.8.4+dfsg-1	-
debian 12	node-axios	=1.2.1+dfsg-1 \|\| >=0 <1.2.1+dfsg-1+deb12u1	1.2.1+dfsg-1+deb12u1
debian 14	node-axios	>=0 <1.6.2+dfsg-1	1.6.2+dfsg-1

Aliases

1. CVE-2023-458572. NVD-2023-458573. OSV-2023-458574. OSV-DEBIAN-2023-458575. GCVE-2023-458576. SECURITY-TRACKER-CVE-2023-45857

References

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.