Detections
Analytics

Echo: github.com/gorilla/csrf: security update to 1.7.3

medium Tenable Cloud Security Plugin ID 455300

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing
 network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form
 at http://example.com can't get it to submit to https://example.com because the Origin header is checked
 with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and
 HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is
 checked. For example, if an application is hosted on https://example.com and adds example.net to
 TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack.
 Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an
 option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the
 github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla. (CVE-2025-47909)

Solution

Update the github.com/gorilla/csrf library and its related packages to version 1.7.3 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-47909

Plugin Details

Severity: Medium

ID: 455300

Version: Revision 1.2

Type: Local

Published: 10/1/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.8

Percentile: 22.92

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2025-47909

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 4.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 8/29/2025

Reference Information

CVE: CVE-2025-47909