GitHub Advisoryadvisory · RubyGems

GHSA-fgmx-8h93-26fh omniauth-oauth2 Cross-Site Request Forgery vulnerability

MEDIUM Published 2017-10-24 Modified 2023-01-25 Official page ↗
Aliases
CVE-2012-6134
Ecosystem
RubyGems
Packages
omniauth-oauth2
Severity
Moderate
Weaknesses
CWE-352
Reviewed
2020-06-16

Affected packages

• RubyGems omniauth-oauth2: < 1.1.1 → fixed in 1.1.1

Description

Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem prior to 1.1.1 for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.

Related

Alias · CVE (1)

  • CVE-2012-6134 Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References