LiveActive security incident?Get immediate response
CVE Record

CVE-2018-25060: Macaron csrf csrf.go missing secure attribute

A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipulation of the argument Generate leads to sensitive cookie without secure attribute. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as dadd1711a617000b70e5e408a76531b73187031c. It is recommended to apply a patch to fix this issue. VDB-217058 is the identifier assigned to this vulnerability.

LowCVSS 3.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2018-25060 is a low-severity issue in Macaron csrf where a sensitive CSRF cookie may be created without the Secure attribute. That can expose the cookie over non-HTTPS transport in some deployments. The sources identify a patch, but do not specify affected versions.

Executive priority

Treat this as routine hygiene unless Macaron csrf is used in sensitive web applications. The main business risk is avoidable leakage of a security cookie in weaker transport conditions, not a broad compromise scenario.

Technical view

The issue is CWE-614 in Macaron csrf csrf.go: Generate can produce a sensitive cookie lacking the Secure attribute. CVSS 3.1 is 3.7 with network attack vector, high attack complexity, no privileges or user interaction, and low confidentiality impact.

Likely exposure

Exposure is limited to applications using the Macaron csrf package, especially where CSRF cookies could traverse non-HTTPS connections. The public bundle lists versions as n/a and provides no CPEs, so asset owners must confirm usage directly.

Exploitation context

The bundle says remote attack is possible but difficult, with high complexity. It does not cite active exploitation, and KEV status is false. No public exploit status beyond the VulDB description is provided.

Researcher notes

Evidence is clear on the missing Secure attribute and patch commit, but incomplete on affected versions, release tags, and real-world exploitation. Validate by dependency inventory and cookie behavior rather than assuming broad exposure.

Mitigation direction

  • Apply the vendor patch associated with commit dadd1711a617000b70e5e408a76531b73187031c.
  • Check upstream Macaron csrf guidance for the first fixed release or backport path.
  • Confirm deployed services use HTTPS and set CSRF cookies with the Secure attribute.

Validation and detection

  • Inventory applications that use Macaron csrf; affected versions are not specified in the sources.
  • Inspect CSRF cookie attributes in staging after updating.
  • Confirm the CSRF cookie includes Secure when served over HTTPS.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-614: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-25060 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
3.7 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
3.7CVSS 3.1LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N2.21.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

3.7Low
CVSS 3.1 vector shape for CVE-2018-25060Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Macaroncsrfn/aListed
Weakness

CWE details

CWE-614

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-614 · source CWE mapping

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs