CVE-2019-19737

—

CVSS 3.1

8.8 high

EPSS

<1%p38

Published

Dec 30, 2019 (Dec 30, 2019)

Modified

Jun 17, 2026

Description

MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requests and potentially be used in cross-site request forgery attacks.

Vendors: mfscripts
Products: yetishare
Weakness: CWE-352
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.