CVE Catalog
CVE-2023-45857
MediumSummary
An issue in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing attackers to view sensitive information.
Risk Assessment
The risk is that an attacker can intercept the XSRF-TOKEN, enabling Cross-Site Request Forgery (CSRF) attacks and session hijacking.
Recommendation
Immediately update Axios to version 1.6.0 or later, which includes a fix that removes this unintended behavior.
Original NVD description (English source)
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.