GitHub Advisoryadvisory · RubyGems

GHSA-cf36-985g-v73c omniauth-facebook Cross-Site Request Forgery vulnerability

MEDIUM Published 2017-10-24 Modified 2023-01-23 Official page ↗
Aliases
CVE-2013-4562
Ecosystem
RubyGems
Packages
omniauth-facebook
Severity
Moderate
Weaknesses
CWE-352
Reviewed
2020-06-16

Affected packages

• RubyGems omniauth-facebook: >= 1.4.1, < 1.5.0 → fixed in 1.5.0

Description

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.

Related

Alias · CVE (1)

  • CVE-2013-4562 The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References