Vulnerability GHSA-pm55-qfxr-h247
Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
4 years ago
August 19, 2022 at 12:00 AM UTC
OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value
0.0.1 - 1.9.1 and 2.0.0.pre.rc1
0.0.1 - 1.9.1 and 2.0.0.pre.rc1
Summary
OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value
Details
lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
7 hours ago
OmniAuth: Host Header Injection Vulnerability
0.0.1 - 2.1.4 GHSA-m27g-v28p-f9fx
0.0.1 - 2.1.4 GHSA-m27g-v28p-f9fx
High Risk
7 years ago
OmniAuth Ruby gem Cross-site Request Forgery in request phase
0.0.1 - 2.0.0.pre.rc1 GHSA-ww4x-rwq6-qpgf
0.0.1 - 2.0.0.pre.rc1 GHSA-ww4x-rwq6-qpgf
High Risk
8 years ago
Omniauth allows POST parameters to be stored in session
0.0.1 - 1.3.1 GHSA-9pr6-grf4-x2fr
0.0.1 - 1.3.1 GHSA-9pr6-grf4-x2fr
Impacted packages
Timeline
Published
4 years ago
August 19, 2022 at 12:00 AM UTC
Last Modified
3 years ago
November 08, 2023 at 04:03 AM UTC