CVE-2012-6134

Опубликовано: 09 апр. 2013

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.

Ссылки

http://rubysec.github.io/advisories/CVE-2012-6134/
Broken Link
http://seclists.org/oss-sec/2013/q1/304
Mailing List
Third Party Advisory
https://gist.github.com/homakov/3673012
Broken Link
https://github.com/Shopify/omniauth-shopify-oauth2/pull/1
Patch
Third Party Advisory
https://github.com/intridea/omniauth-oauth2/pull/25
Patch
Third Party Advisory
http://rubysec.github.io/advisories/CVE-2012-6134/
Broken Link
http://seclists.org/oss-sec/2013/q1/304
Mailing List
Third Party Advisory
https://gist.github.com/homakov/3673012
Broken Link
https://github.com/Shopify/omniauth-shopify-oauth2/pull/1
Patch
Third Party Advisory
https://github.com/intridea/omniauth-oauth2/pull/25
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:omniauth-oauth2_project:omniauth-oauth2:*:*:*:*:*:ruby:*:*

Версия до 1.1.1 (исключая)

EPSS

Процентиль: 22%

0.00072

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

CVE-2012-6134

debian

почти 13 лет назад

Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 ...

GHSA-fgmx-8h93-26fh

github

больше 8 лет назад

omniauth-oauth2 Cross-Site Request Forgery vulnerability