Vulnerability GHSA-ww4x-rwq6-qpgf
High Risk
HIGH RISK
CVSS Score: 8.8
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
7 years ago
May 29, 2019 at 07:11 PM UTC
OmniAuth Ruby gem Cross-site Request Forgery in request phase
0.0.1 - 2.0.0.pre.rc1
0.0.1 - 2.0.0.pre.rc1
Summary
OmniAuth Ruby gem Cross-site Request Forgery in request phase
Details
The request phase of the OmniAuth Ruby gem (1.9.2 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.
As of v2 OmniAuth no longer has the vulnerable configuration by default, but it is still possible to configure OmniAuth in such a way that the web application becomes vulnerable to Cross-Site Request Forgery. There is a recommended remediation described here.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
7 hours ago
OmniAuth: Host Header Injection Vulnerability
0.0.1 - 2.1.4 GHSA-m27g-v28p-f9fx
0.0.1 - 2.1.4 GHSA-m27g-v28p-f9fx
Critical
4 years ago
OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value
0.0.1 - 1.9.1 and 2.0.0.pre.rc1 GHSA-pm55-qfxr-h247
0.0.1 - 1.9.1 and 2.0.0.pre.rc1 GHSA-pm55-qfxr-h247
High Risk
8 years ago
Omniauth allows POST parameters to be stored in session
0.0.1 - 1.3.1 GHSA-9pr6-grf4-x2fr
0.0.1 - 1.3.1 GHSA-9pr6-grf4-x2fr
Impacted packages
Timeline
Published
7 years ago
May 29, 2019 at 07:11 PM UTC
Last Modified
2 years ago
February 16, 2024 at 08:21 AM UTC