GitHub Advisoryadvisory · RubyGems

GHSA-mvqr-r76c-wm5f Devise Token Auth vulnerable to Cross-site Scripting

MEDIUM Published 2022-05-24 Modified 2023-07-17 Official page ↗
Aliases
CVE-2019-16751
Ecosystem
RubyGems
Packages
devise_token_auth
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-03-08

Affected packages

• RubyGems devise_token_auth: >= 0.1.33, < 1.1.3 → fixed in 1.1.3

Description

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting (XSS) through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects the `fallback_render` method in the omniauth callbacks controller.

Related

Alias · CVE (1)

  • CVE-2019-16751 An issue was discovered in Devise Token Auth through 1.1.2. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References