Описание
A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.
A flaw was found in rubygem-actionview. A regression of CVE-2015-1840 causes Rails-ujs to send CSRF tokens to wrong domains. The highest threat from this vulnerability is to data integrity.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| CloudForms Management Engine 5 | cfme-amazon-smartstate | Not affected | ||
| CloudForms Management Engine 5 | cfme-gemset | Will not fix | ||
| Red Hat Satellite 6.9 for RHEL 7 | ansible-collection-redhat-satellite | Fixed | RHSA-2021:1313 | 21.04.2021 |
| Red Hat Satellite 6.9 for RHEL 7 | ansiblerole-foreman_scap_client | Fixed | RHSA-2021:1313 | 21.04.2021 |
| Red Hat Satellite 6.9 for RHEL 7 | ansiblerole-insights-client | Fixed | RHSA-2021:1313 | 21.04.2021 |
| Red Hat Satellite 6.9 for RHEL 7 | ansiblerole-satellite-receptor-installer | Fixed | RHSA-2021:1313 | 21.04.2021 |
| Red Hat Satellite 6.9 for RHEL 7 | ansible-runner | Fixed | RHSA-2021:1313 | 21.04.2021 |
| Red Hat Satellite 6.9 for RHEL 7 | candlepin | Fixed | RHSA-2021:1313 | 21.04.2021 |
| Red Hat Satellite 6.9 for RHEL 7 | createrepo_c | Fixed | RHSA-2021:1313 | 21.04.2021 |
| Red Hat Satellite 6.9 for RHEL 7 | foreman | Fixed | RHSA-2021:1313 | 21.04.2021 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.
A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.
A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that co ...
Уязвимость программной платформы Ruby on Rails, связанная с подделкой межсайтовых запросов, позволяющая нарушителю отправлять токены CSRF на неправильные домены
EPSS
7.5 High
CVSS3