GitHub Advisoryadvisory · RubyGems
GHSA-8fqx-7pv4-3jwm Improper Input Validation in actionpack
MEDIUM
Official page ↗
- Aliases
- CVE-2008-7248
- Ecosystem
- RubyGems
- Packages
- actionpack
- Severity
- Moderate
- Weaknesses
- CWE-20
- Reviewed
- 2020-06-16
Affected packages
• RubyGems actionpack: >= 2.1.0, < 2.1.3 → fixed in 2.1.3
• RubyGems actionpack: >= 2.2.0, < 2.2.2 → fixed in 2.2.2
Description
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
Related
Alias · CVE (1)
- CVE-2008-7248 Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2008-7248 advisory
- https://github.com/rails/rails/commit/099a98e9b7108dae3e0f78b207e0a7dc5913bd1a web
- https://access.redhat.com/security/cve/CVE-2008-7248 web
- https://bugzilla.redhat.com/show_bug.cgi?id=544329 web
- https://github.com/rails/rails package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2008-7248.yml web
- https://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en web
- https://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html web
- https://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup web
- https://web.archive.org/web/20090906010200/https://www.vupen.com/english/advisories/2009/2544 web
- https://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1 web
- https://www.openwall.com/lists/oss-security/2009/11/28/1 web
- https://www.openwall.com/lists/oss-security/2009/12/02/2 web
- https://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html web
- http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en web
- http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html web
- http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup web
- http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1 web
- http://www.openwall.com/lists/oss-security/2009/11/28/1 web
- http://www.openwall.com/lists/oss-security/2009/12/02/2 web