Medium CVE-2012-6134 EUVD-2017-0228GHSA-fgmx-8h93-26fh

omniauth-oauth2 Cross-Site Request Forgery vulnerability

Published Apr 9, 2013 · Updated Sep 17, 2024 · Assigned by redhat

Package: omniauth-oauth2 Ecosystem: RubyGems

Description

Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
RubyGems	omniauth-oauth2	< 1.1.1	1.1.1	GHSA-fgmx-8h93-26fh

References

https://github.com/Shopify/omniauth-shopify-oauth2/pull/1
https://github.com/intridea/omniauth-oauth2/pull/25
http://rubysec.github.io/advisories/CVE-2012-6134/
https://gist.github.com/homakov/3673012
[oss-security] 20130213 Some rubygems related CVEs mailing-list