Cross-Site Request Forgery in omniauth-oauth2 Gem by Intridea
CVE-2012-6134

Currently unrated

Key Information:

Vendor: Omniauth-oauth2 Project
Status: Omniauth-oauth2
Vendor: CVE Published:; 9 April 2013

🔔 Create Omniauth-oauth2 Project Vulnerability Alert

What is CVE-2012-6134?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the omniauth-oauth2 gem versions 1.1.1 and earlier. This flaw allows remote attackers to exploit the authentication processes of users, enabling them to send unauthorized requests that may alter session states. Consequently, the security of applications utilizing this gem could be compromised, leading to potential data breaches or unauthorized access.

References

https://github.com/Shopify/omniauth-shopify-oauth2/pull/1

x_refsource_MISC

https://github.com/intridea/omniauth-oauth2/pull/25

x_refsource_CONFIRM

http://rubysec.github.io/advisories/CVE-2012-6134/

x_refsource_MISC

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability Reserved
Oct 3, 2022
Vulnerability published
Apr 9, 2013

CVE-2012-6134 Data

JSON