{"id":"CVE-2018-20595","details":"A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful.","aliases":["GHSA-4rm3-4mq4-mfwr"],"modified":"2026-08-07T16:57:23.979536Z","published":"2018-12-30T18:29:00.693Z","references":[{"type":"REPORT","url":"https://github.com/hs-web/hsweb-framework/issues/107"},{"type":"FIX","url":"https://github.com/hs-web/hsweb-framework/commit/40929e9b0d336a26281a5ed2e0e721d54dd8d2f2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hs-web/hsweb-framework","events":[{"introduced":"a82c50a57ff0837005bf6409378ea0c8a7e3dbc6"},{"last_affected":"a82c50a57ff0837005bf6409378ea0c8a7e3dbc6"},{"fixed":"40929e9b0d336a26281a5ed2e0e721d54dd8d2f2"}],"database_specific":{"cpe":"cpe:2.3:a:hsweb:hsweb:3.0.4:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.0.4"},{"last_affected":"3.0.4"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["3.0.4","3.0.4-release"],"database_specific":{"vanir_signatures_modified":"2026-08-07T16:57:23Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/hs-web/hsweb-framework/commit/40929e9b0d336a26281a5ed2e0e721d54dd8d2f2","target":{"file":"hsweb-system/hsweb-system-oauth2-client/hsweb-system-oauth2-client-web/src/main/java/org/hswebframework/web/authorization/oauth2/controller/OAuth2ClientController.java"},"deprecated":false,"digest":{"line_hashes":["230303649916875244422071930711841632530","278026214785946609548608757833330806538","67061948506001062571253588914772891295","166784916818526258638762226195245021425","320363351148407479536331651366295910022","253905793729530242737807639877453832079","99850839909525910275641823481022920139","281524178365071811868608847584290667013","65846152653369508363829216509718087966","114684106868784432929414386201199848411","146902289802109031117439200909533373200","320713736829581577660521646176502708694"],"threshold":0.9},"id":"CVE-2018-20595-15ae4091","signature_type":"Line"},{"deprecated":false,"digest":{"length":513,"function_hash":"76198728433516612500922278359692897974"},"id":"CVE-2018-20595-60c3b82a","signature_type":"Function","signature_version":"v1","source":"https://github.com/hs-web/hsweb-framework/commit/40929e9b0d336a26281a5ed2e0e721d54dd8d2f2","target":{"file":"hsweb-system/hsweb-system-oauth2-client/hsweb-system-oauth2-client-web/src/main/java/org/hswebframework/web/authorization/oauth2/controller/OAuth2ClientController.java","function":"callback"}},{"id":"CVE-2018-20595-7f4eb4a1","signature_type":"Line","signature_version":"v1","source":"https://github.com/hs-web/hsweb-framework/commit/40929e9b0d336a26281a5ed2e0e721d54dd8d2f2","target":{"file":"hsweb-authorization/hsweb-authorization-oauth2/hsweb-authorization-oauth2-core/src/main/java/org/hswebframework/web/oauth2/core/ErrorType.java"},"deprecated":false,"digest":{"line_hashes":["277556676081724025417103193708988421527","123180681127283065209892170645053211984","306325979264998545528937977148956184501"],"threshold":0.9}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20595.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}