CVE-2016-15005

8.8 highEPSS 0.4%

CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2022-12-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

golf_project:golf

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-q9qr-jwpw-3qvv	Go	github.com/dinever/golf	<0.3.0	0.3.0
GO-2020-0045	Go	github.com/dinever/golf	<0.3.0	0.3.0

References

https://github.com/dinever/golf/commit/3776f338be48b5bc5e8cf9faff7851fc52a3f1fe
https://github.com/dinever/golf/issues/20
https://github.com/dinever/golf/pull/24
https://pkg.go.dev/vuln/GO-2020-0045
https://github.com/dinever/golf/commit/3776f338be48b5bc5e8cf9faff7851fc52a3f1fe

Check your stack JSON