CVE-2020-35217

CVE-2020-35217 describes a critical Cross-Site Request Forgery (CSRF) vulnerability in the Vert.x-Web framework versions 4.0 milestone 1-4. The framework's flawed CSRF verification logic, which compares the cookie's token against a session-stored token instead of the request's token, allows attackers to bypass protection entirely, as no request token is even required. This vulnerability carries a high CVSS score of 8.8, indicating a network-based attack with low complexity, requiring user interaction, and potentially leading to high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.