Skip to content
OpenAdvisories

Package · Debian

ruby-omniauth

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2015-9284

    OmniAuth Ruby gem Cross-site Request Forgery in request phase

    The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This…

    ruby-omniauth ruby-omniauth omniauth Debian Ubuntu RubyGems
  • High 7.5
    CVE-2017-18076

    Omniauth allows POST parameters to be stored in session

    In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.

    ruby-omniauth ruby-omniauth omniauth Debian Ubuntu RubyGems