Vulnerability GHSA-9pr6-grf4-x2fr
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
8 years ago
January 29, 2018 at 03:45 PM UTC
Omniauth allows POST parameters to be stored in session
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.3.1
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.3.1
Summary
Omniauth allows POST parameters to be stored in session
Details
In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
7 hours ago
OmniAuth: Host Header Injection Vulnerability
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.9.2 and 2.0.0.pre.rc1 and 2.0.0 - 2.1.4 GHSA-m27g-v28p-f9fx
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.9.2 and 2.0.0.pre.rc1 and 2.0.0 - 2.1.4 GHSA-m27g-v28p-f9fx
Critical
4 years ago
OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.9.1 and 2.0.0.pre.rc1 GHSA-pm55-qfxr-h247
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.9.1 and 2.0.0.pre.rc1 GHSA-pm55-qfxr-h247
High Risk
7 years ago
OmniAuth Ruby gem Cross-site Request Forgery in request phase
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.9.2 and 2.0.0.pre.rc1 GHSA-ww4x-rwq6-qpgf
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.9.2 and 2.0.0.pre.rc1 GHSA-ww4x-rwq6-qpgf
Impacted packages
Timeline
Published
8 years ago
January 29, 2018 at 03:45 PM UTC
Last Modified
1 year ago
December 03, 2024 at 06:18 AM UTC