Cyber Resilience

CVE-2023-45141

CSRF in Gofiber Fiber ≤ 2.50.0

Published
16 October 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 8.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
EPSS Score 0.0027 18th percentile
Risk Priority 63 floored blend · peak EPSS

Summary

CVE-2023-45141 is a high-severity CSRF (CWE-352) vulnerability in Gofiber Fiber. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Web Session Cookie (T1550.004); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can…

more

lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This vulnerability has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1550 Use Alternate Authentication Material Lateral Movement
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-45128Same product: Gofiber Fiber
CVE-2024-28233Shared CWE-352, CWE-565
CVE-2026-8337Shared CWE-565
CVE-2023-3747Shared CWE-565
CVE-2023-32725Shared CWE-565
CVE-2024-55211Shared CWE-565
CVE-2025-31120Shared CWE-565
CVE-2024-0947Shared CWE-565
CVE-2025-14440Shared CWE-565
CVE-2026-39963Shared CWE-565

Affected Assets

gofiber
fiber
≤ 2.50.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V3.3.2
  • V3.5.1
  • V10.2.1

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-352

Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.

addresses: CWE-352

Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.

addresses: CWE-352

Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.

addresses: CWE-352

Detects anomalous request patterns consistent with cross-site request forgery.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-04 full match
prevents

Cookies commonly carry identity assertions; requiring their protection, conveyance, and verification directly eliminates the weakness.

PR.AA-03 mostly match
prevents

Strong authentication mechanisms reduce reliance on unvalidated cookies for identity and access decisions.

PR.DS-02 mostly match
prevents

Cryptographic integrity for data-in-transit directly mitigates tampering of cookies sent over the network.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.

PR.AA-05 partial match
prevents

Enforcing access policy and least privilege limits damage from cookie misuse but does not address cookie validation itself.

PR.DS-01 partial match
prevents

Integrity protections for data-at-rest can apply to cookie stores but do not cover validation during use.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect cookie-validation flaws but does not itself implement the required controls.

mitigates

By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.

prevents

Application security requirements can mandate cookie validation, integrity protection, and server-side session handling.

prevents

Secure coding practices directly eliminate reliance on unvalidated cookies by requiring proper integrity checks and server-side verification.

prevents

Secure authentication mechanisms can enforce server-side validation and integrity checks that prevent reliance on untrusted cookies.

none

Contextual intelligence about emerging CSRF toolkits can be translated into updated anti-CSRF token or same-site policy configurations across applications.

References