Cross-Site Request Forgery Vulnerability in OmniAuth Ruby Gem by OmniAuth
CVE-2015-9284

8.8HIGH

Key Information:

Vendor

Omniauth

Status
Omniauth Ruby Gem
Vendor
CVE Published:
26 April 2019

What is CVE-2015-9284?

The OmniAuth Ruby gem version 1.9.1 and earlier contains a vulnerability that exposes it to Cross-Site Request Forgery (CSRF) when integrated with Ruby on Rails. This loophole allows unauthorized connections between accounts without user consent or knowledge. Essentially, under specific conditions, a secondary account can gain access to a primary user's session, compromising the integrity of the web application security.

Affected Version(s)

omniauth ruby gem All versions

References

https://github.com/omniauth/omniauth/pull/809
x_refsource_MISC
https://github.com/omniauth/omniauth-rails/pull/1
x_refsource_MISC
https://www.openwall.com/lists/oss-security/2015/05/26/11
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.