Upstream information

CVE-2025-47909 at MITRE

Description

Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin header is checked with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is checked. For example, if an application is hosted on https://example.com and adds example.net to TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack. Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla.

SUSE information

Overall state of this security issue: Pending

This issue is currently rated as having moderate severity.

CVSS v3 Scores
  CNA (CISA-ADP) SUSE
Base Score 7.3 6.8
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack Vector Network Network
Attack Complexity Low High
Privileges Required None None
User Interaction None Required
Scope Unchanged Unchanged
Confidentiality Impact Low High
Integrity Impact Low High
Availability Impact Low None
CVSSv3 Version 3.1 3.1
CVSS v4 Scores
  SUSE
Base Score 7.6
Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Attack Vector Network
Attack Complexity Low
Attack Requirements Present
Privileges Required None
User Interaction Passive
Vulnerable System Confidentiality Impact High
Vulnerable System Integrity Impact High
Vulnerable System Availability Impact None
Subsequent System Confidentiality Impact None
Subsequent System Integrity Impact None
Subsequent System Availability Impact None
CVSSv4 Version 4.0
SUSE Bugzilla entry: 1248966 [NEW]

No SUSE Security Announcements cross referenced.


SUSE Timeline for this CVE

CVE page created: Fri Aug 29 20:01:59 2025
CVE page last modified: Sat Aug 30 12:54:43 2025