Security readout for executives and security teams
Plain-English summary
nsupdate.info had a configuration issue that left the CSRF cookie without the HttpOnly protection. This can make the cookie easier for browser-side script to read if another client-side weakness exists. The published score is low, and the provided sources do not show active exploitation.
Executive priority
Treat this as a low-priority hygiene fix unless nsupdate.info is internet-facing, heavily customized, or already affected by client-side script risks. Confirm inventory and patch status, but this does not indicate emergency response from the provided evidence.
Technical view
CVE-2019-25091 is CWE-1004 in nsupdate.info's CSRF Cookie Handler, tied to src/nsupdate/settings/base.py and CSRF_COOKIE_HTTPONLY. The CVSS 3.1 score is 3.7 with network attack vector, high complexity, no privileges, and low confidentiality impact. A patch is identified as commit 60a3fe559c453bc36b0ec3e5dd39c1303640a59a.
Likely exposure
Exposure is most likely limited to organizations running nsupdate.info deployments based on code before the referenced patch. The source bundle does not identify affected versions, packages, hosted service exposure, or CPEs, so inventory confirmation is required.
Exploitation context
The sources describe remote attack possibility and low confidentiality impact, but provide no KEV listing and no cited evidence of active exploitation. Practical risk appears conditional because a readable CSRF cookie is usually more concerning alongside browser-side script exposure.
Researcher notes
The record lacks affected version ranges and names an unknown part beyond base.py, limiting precision. The patch reference is concrete, and CVSS indicates confidentiality-only impact. Do not infer exploit availability or broader product impact from the provided data.
Mitigation direction
- Identify whether nsupdate.info is deployed or forked in your environment.
- Confirm the deployment includes commit 60a3fe559c453bc36b0ec3e5dd39c1303640a59a or later equivalent.
- If not patched, apply the upstream patch through normal change control.
- Check upstream nsupdate.info guidance for any version-specific remediation not present in the bundle.
- Review cookie security settings for consistent HttpOnly handling where appropriate.
Validation and detection
- Review nsupdate.info source provenance for the referenced patch commit.
- Inspect the effective CSRF cookie settings in the deployed configuration.
- Validate the CSRF cookie attributes in a staging browser session.
- Check vulnerability tracking for nsupdate.info entries lacking fixed-version evidence.
- Document whether exposure is present, absent, or unverifiable due to missing version data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1004: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-25091 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N2.21.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.7LowVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://vuldb.com/?id.216909CVE reference · vdb-entry, technical-description
- https://vuldb.com/?ctiid.216909CVE reference · signature, permissions-required
- https://github.com/nsupdate-info/nsupdate.info/pull/410CVE reference · issue-tracking, patch
- https://github.com/nsupdate-info/nsupdate.info/commit/60a3fe559c453bc36b0ec3e5dd39c1303640a59aCVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Sensitive Cookie Without 'HttpOnly' Flag
Sensitive Cookie Without 'HttpOnly' Flag represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.